The chances of the same question being posted by multiple people seems pretty unlikely and given how often this happens - why post under many usernames? Anyway, to the problem at hand. Did you try the documentation? A quick search reveals; http://docs.splunk.com/Documentation/Splunk/5.0.1/Indexer/HowSplunkstoresindexes This is very comprehensive and theres little point in me summarising it here, if you read it then you'll have a complete understanding of how Splunk stores and where it stores this data. The rawdata is needed to rebuild the metadata should the buckets ever become corrupted or unable to be read by Splunk, this is also important in a clustered environment where you can choose how many copies of the raw data are available for recovery purposes. EDIT: Oh and a final consideration, if you are indexing events from local log files then you also have to consider that the original data will also remain - depending on the retention/rolling policies already in place ... View more

You don't need to disable it, as it suggests you just need to add a Crcsalt so it doesn't match the other file it appears to have read in. Usually this suggests that the header of the file is identical to other files you're indexing or you have indexed duplicates so take care, but you can add this to your [monitor] stanza in inputs.conf for the related file; crcSalt = <SOURCE> With the <SOURCE> keyword included exactly as its typed above. This will force Splunk to use the source path in the cRc check and avoid matching similar logs from other files. If you use a different filename for dev work then you shouldn't hit any problems. Otherwise you may just want to avoid clearing the log, once its indexed in Splunk you could just note the timestamp of the dev change and ignore all data indexed before that. ... View more

With questions like this it always helps to paste your XML as its pretty impossible to figure out where the mistake is. That said however, you are describing the behaviour of an XML page trying to use a sideview module without adding the magic code of; <module name="SideviewUtils" layoutpanel="appHeader"/> To the top of your XML 🙂 If this doesn't help then post some XML we can check out. ... View more

From props.conf heres a definition; #****************************************************************************** # Small file settings #****************************************************************************** PREFIX_SOURCETYPE = [true|false] * NOTE: this attribute is only relevant to the "[too_small]" sourcetype. * Determines the source types that are given to files smaller than 100 lines, and are therefore not classifiable. * PREFIX_SOURCETYPE = false sets the source type to "too_small." * PREFIX_SOURCETYPE = true sets the source type to "<sourcename>-too_small", where "<sourcename>" is a cleaned up version of the filename. * The advantage of PREFIX_SOURCETYPE = true is that not all small files are classified as the same source type, and wildcard searching is often effective. * For example, a Splunk search of "sourcetype=access*" will retrieve "access" files as well as "access-too_small" files. * Defaults to true. I've not hit many too_small sourcetypes in my time but is it possible it was too small and thats now the sourcetype associated with it? My understanding is that if you provide a sourcetype in a config then it will use that instead of the too_small keyword. http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Renamesourcetypes It might be an idea to try that and then re-index your data. ... View more