Deployment Architecture

Why are we seeing .dat files created in the cold to frozen path?

athorat
Communicator

alt text

We started seeing .dat files for all the indexes since 4th of august at the following path: /opt/splunk/var/lib/splunk
This is where the cold to frozen is pointed to.
There are no changes or upgrades on the server. Is anything wrong with the configurations?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

These .dat files hold the next bucket ID to be created for that index, and they aren't influenced by homePath etc. settings in indexes.conf... mostly harmless.

ddrillic
Ultra Champion

It seems to be just fine as I see these tiny files as well and they hold numbers. _thefishbucket.dat holds a zero in my case, maybe the number of buckets.. ?

We can see an old refrefence (from 04/03/15) to these *.dat files at Why do I only see the current day's results in searches and should all files in /opt/splunk/var/lib/...

It says -

-- I'm a total splunk newbie, and I inherited a splunk server running on Red Hat Enterprise Linux 5. The other day, I did a reboot of the system. Since then, I can only view the current day's data when I run a search. The version of splunk is 5.0.9. Build 213964 Platform linux x86_64. The splunkd service is running as root, but when I look in /opt/splunk/var/lib/splunk, I see that all the files except for the ones ending in .dat are owned by splunk:splunk. The .dat files are owned by root:root. Should they all be owned by root?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...