My Splunk partition is filling, due to one file...
/opt/splunk/var/lib/splunk/rscache.data
...this file contains logging from a DBconnect v2 connection that I setup last week.
Deleted the file. How can I tune this? Nothing jumps out at me within dbx.
Thanks.
I think its actually required and there isn't any configuration that I can see to relocate it.
Also "huge" is relative to the volume of data that db connect is shuffling around.
How big was huge?