Splunk Enterprise

What is "default.old.<date>" and can it be removed

fatsug
Contributor

Hello community

After a small "snafu" with new dashboards and version number, I noticed that after the rollout in our distributed environment there was, what seemed like, a local backup present:

    /opt/splunk/etc/apps/<appname>/default.old.20220705-235555/

The date lines up with the rollout of dashboards receiving a "This dashboard view is deprecated and will be removed in future versions of Splunk software" error.  Hence, I suspect these are connected in some way.

So the dashboards were "repaired" by just dropping the version number by "1", though the "backup files" are still there.

The only difference I notice are the install_source_checksum and the changes made to dashboards.

So, is it OK to just delete this "backup" folder? If so, is there a preferred way to do so or just remove it?

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I believe it is safe to remove the "default.old" folders.  There's no Splunk way to do it so just use rm -r.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I believe it is safe to remove the "default.old" folders.  There's no Splunk way to do it so just use rm -r.

---
If this reply helps you, Karma would be appreciated.

fatsug
Contributor

I've been watching the folder and it has not been accessed once, neither is there a single difference except for the later modification. Hence, removing it seemed safe enough and I have not observed any issues.

Thx

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...