Security

Are old diag-temp files needed? (Probably not.)

I_am_Jeff
Communicator

Looking to recover some disk space. Can I delete old diag-temp directories, anything under run/splunk/diag-temp? Here are some samples I've pasted from tar(1) output.

 
./run/splunk/diag-temp/diag-hostname-2010-11-23/etc/ngram-models/_hebrew-ISO-8859-8.ngrams, 1244 bytes, 3 tape blocks
x ./var/run/splunk/diag-temp/diag-hostname-2010-11-23/etc/ngram-models/_bosnian.ngrams, 1247 bytes, 3 tape blocks
x ./var/run/splunk/diag-temp/diag-hostname-2010-11-23/etc/ngram-models/_slovak-CP1250.ngrams, 1215 bytes, 3 tape blocks
x ./var/run/splunk/diag-temp/diag-hostname-2010-11-23/etc/ngram-models/_sanskrit.ngrams, 1207 bytes, 3 tape blocks
x ./var/run/splunk/diag-temp/diag-hostname-2010-11-23/etc/ngram-models/_hindi.ngrams, 1244 bytes, 3 tape blocks
x ./var/run/splunk/diag-temp/diag-hostname-2010-11-23/etc/ngram-models/_catalan.ngrams, 1273 bytes, 3 tape blocks

I believe the answer is, "Those are not needed beyond troubleshooting and can be removed," but would like confirmation.

Thanks in advance!

Tags (2)
1 Solution

yannK
Splunk Employee
Splunk Employee

Those file should be deleted after the generation of the diag. It may have failed.
You can remove the folder siat-temp safely to claim space.

View solution in original post

yannK
Splunk Employee
Splunk Employee

Those file should be deleted after the generation of the diag. It may have failed.
You can remove the folder siat-temp safely to claim space.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...