Splunk Enterprise Security

$SPLUNK_HOME/var/lib/splunk/modinputs taking up disk space

Hi All,

The data checkpoint file for cloudtrail logs is taking up a lot of disk space (over 100 GB). Is this a normal behaviour?
Where can I check the modular input script. We are having issues of full disk space due to this.
Any help would be appreciated

0 Karma