This app will eventually consume all available space on the search head it is installed on. Documentation does not address this. Response from developer goes unanswered.
I attempted to create a file called
tsidx_retention.conf
with the following
[bluecoat_stats]
retentionTimePeriodInSecs = 432000
I placed it at:
/opt/splunk/etc/apps/SplunkforBlueCoat/local/tsidx_retention.conf
But this is not working.
I could use help with this too. I was hoping that someone would have answered this by now.
Thanks for asking the question
Hi,
Same issue here.
I'm doing it with an external script which runs every week and looks for "old" tsidx files to remove them.
Could anyone from Splunk answer this please ?
Thanks in advance