What is "default.old.<date>" and can it be removed

[fatsug]

Hello community

After a small "snafu" with new dashboards and version number, I noticed that after the rollout in our distributed environment there was, what seemed like, a local backup present:

    /opt/splunk/etc/apps/<appname>/default.old.20220705-235555/

The date lines up with the rollout of dashboards receiving a "This dashboard view is deprecated and will be removed in future versions of Splunk software" error.  Hence, I suspect these are connected in some way.

So the dashboards were "repaired" by just dropping the version number by "1", though the "backup files" are still there.

The only difference I notice are the install_source_checksum and the changes made to dashboards.

So, is it OK to just delete this "backup" folder? If so, is there a preferred way to do so or just remove it?

[richgalloway · Accepted solution]

I believe it is safe to remove the "default.old" folders.  There's no Splunk way to do it so just use rm -r.

[fatsug]

I've been watching the folder and it has not been accessed once, neither is there a single difference except for the later modification. Hence, removing it seemed safe enough and I have not observed any issues.

Thx