Large Source.data file

[nlothian]

We have a very large Source.data file, which we think maybe causing issues. It contains around 50 million rows.

Is there anyway to reduce this file's size?

Does Source.data refer to sources for data that is stored in cold or frozen indexes?

[Ant1D]

Had an issue where my Splunk instance went down. When looking at the internal logs, I saw the sources.data file mentioned and the file size exceeded 8GB. This seemed to be the cause of Splunk not working. I am not sure if you can reduce the size of this file but if you move your current sources.data file to a location outside of Splunk and then restart your Splunk instance, a new sources.data file is created.

[Takajian]

Source.data refer to sources for data that is stored in hot and warm and cold, not frozen. I recommend you to reduce the source of inputs.data.