I'm using dbConnect, and my $SPLUNK_HOME/var/spool/dbmon directory is filling up with old data. I've checked dbx/local/inputs.conf and the move policy value is set to sinkhole. We have another Splunk environment with the same config parameters that seems to be maintaining the dbmon directory correctly. What else can I look at?
The "Answer Your Own Question" button isn't working for me for some reason, so posting this here:
Turns out this is a result of slower indexer performance in the environment exhibiting this behavior combined with a large amount of data generated by this query. Waiting long enough caused the data to be indexed and deleted as expected.
Generally splunk would delete the file one they have been indexed. Can you confirm whether the files have already been indexed? Also check the splunkd.log for relevant errors.
