We have splunk running on a linux server and it keeps crashing due to low disk space. I've traced the culprit to the server not being out of space, but running out if inodes. There is an extraordinary large amount (hundreds of thousands) of session-***** and session-*****.lock files in /opt/splunk/var/run/splunk. They go back 2-3 months. Why isnt splunk purging these old files? Any advice?
Can post log files as requested.
... View more