Looks like mine are coming from the NetApp Ontap app and are being stored on the search head with the app. 2.1G /local/splunk/var/lib/splunk/tsidxstats/netapp_perf_aggr 53G /local/splunk/var/lib/splunk/tsidxstats/netapp_perf_disk 14G /local/splunk/var/lib/splunk/tsidxstats/netapp_perf_lun 9.7G /local/splunk/var/lib/splunk/tsidxstats/netapp_perf_volume ... View more

I had the same problem on 6.3.0. I deleted the stash_new files and re-ran the backfill commands, and now the data is showing up correctly. Thanks ... View more

Ok, Not sure whats happening. So do you have have schedule task or cron job copy the directories/files over? Are you using CRCsalt? Install SOS (Splunk on Splunk) App or search the _internal index for the source which may give you some ideas. Considerchanging your File checksum configuration to [endpoint_md5|entire_md5|modtime] in your props.conf. If no luck up your logging channels on your indexer (I am not familar with all the logging channels): FileInputTracker FileTracker recordFileManager WatchedFile Also keep in mind that Splunk indexes its own logs as well as those from your Forwarders which is stored in the _internal index. _internal does not count against your license. Hope this helps or gets you started. ... View more