As stated in previous answers articles, these files are used for summary indexing. In a default installation, there is an batch stanza in the default inputs.conf file which reads the files and removes them.
[batch://$SPLUNK_HOME/var/spool/splunk/...stash_new]
queue = stashparsing
sourcetype = stash_new
move_policy = sinkhole
crcSalt = <SOURCE>
Check for a stanza which monitors the same files. In this case, it was in $SPLUNK_HOME/etc/system/local/inputs.conf.
[monitor://$SPLUNK_HOME/var/spool/splunk/...stash_new]
disabled = 0
In newer versions of Splunk, having a batch and monitor stanza on the same files will prevent them from being removed. To resolve this, remove the monitor stanza and restart splunk.
... View more