The answer is that you likely have both the Exchange and Windows app installed, which is the issue. To me this is something that should be addressed ASAP, it seems like a very serious issue that any Splunk customer that installs both apps gets their disk space blown up (unsure which versions of Splunk this affects):
| rest splunk_server=local /services/server/introspection/kvstore/collectionstats
| fields data
| mvexpand data
| rename data as _raw
| fields - _raw
| fields ns size storageSize totalIndexSize
And it showed me that the terminal service trackers are the culprits:
splunk_app_microsoft_exchange.tSessions_collection and splunk_app_windows_infrastructure.tSessions_collection
Per @automine, app savedsearches likely have the same name and are using the same collection. You can disable tSessions_Lookup_Update* savedsearches in the apps, or, like the Documentation link says, just uninstall the Windows Infra app.
I had a similar issue and had to uninstall the app to free up diskspace (tSessions_collection was using ~150G). I re-installed the app without the tSessions_collection stanza in collections.conf as the session info isn't so important to us. There are probably better ways to filter unwanted noise before it gets to the app, but I needed to free up space quickly.
Thanks, I too had a similar situation to free up disk space quickly so I moved Kvstore to another drive. Now it has increased from 40GB to 52GB.
I am still trying to get hang of splunk and was wondering if you have any article which I can use to uninstall the Windows Infrastructure app (without the tSessions_collection).