Monitoring Splunk

Why is the rs_swap directory under var folder of Splunk filling very fast and causing disk space issues?

girishchhabra19
New Member

There is rs_Swap directory under my Splunk var folder.
It is filling very fast and causes disk space issue.

Any inputs on that?

0 Karma

plaxos
Explorer

There is some information if you search in Answers for rsCache.data
https://answers.splunk.com/answers/235659/just-installed-dbx-v2-what-is-rscachedata-used-for.html

0 Karma
Get Updates on the Splunk Community!

Insights from .conf 2025, Smart Edge Processor Scaling, and a New Splunk Lantern ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Machine Learning - Assisted Adaptive Thresholding

Let’s talk thresholding. Have you set up static thresholds? Tired of static thresholds triggering false ...

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...