I've worked out for myself how to search _internal files - I do RTFM. I still have no idea what they are indexing, but this error seems to appear every 5 minutes or so in it. ERROR databasePartitionPolicy - Still throttling, indexing paused waiting for optimize for _internal. Check to see if the disk is nearly full, as this situation may prevent splunk-optimize from running, causing perpetual throttling. I am not knowingly indexing windows events - does splunk do this by default? If it does, ho do I stop it? The PC only runs Splunk, so if CPU is high, Splunk is the cause. ... View more

I'm now getting this message... The running job "rt_1353419849.11" was canceled remotely or expired (but for multiple jobs) I see from another solution, this could be a clock error, but my times are correct, or to do with .lock files. Could this relate to my large _internal size? ... View more

I don't know if it helps, but i've analysed the indexes from the GUI and this is what was displayed. series sum(MB) _internal 156.101745613 main 1.4854517016 _audit 0.176021572 I'm guessing main is our syslog data, but why is _internal so big and what is it? Can we reduce it's size or what it is accumulating? ... View more

OOps, The software is on the C: partition. Restarted splunk again and this is the output... splunk start Splunk> All batbelt. No tights. Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking configuration... Done. Checking index directory... Validated databases: _audit _blocksignature _internal _thefishbucket his tory main summary Done Success Checking conf files for typos... All preliminary checks passed. Starting splunk server daemon (splunkd)... Splunkd: Starting (pid 4576) ... View more

Hi The hard drive is partitioned. The splunk partition (F:) contains all things splunk. According to Windoze it is 54.9GB I have used 654MB - this includes the software, indexes, everything. As I said, we have very low usage! Restarting doesn't seem to have made any difference. ... View more