I have a lot older of .bundle files in my var\run directory on our Deployment Server. I would like to know if it is safe to delete the ones older than say 1 day. I have seen posts around var\run\searchpeers but not the var\run folder.
e.g. Is this safe?
splunk stop
delete files older than one or two days
splunk start
Yes, see this answer:
https://answers.splunk.com/answers/419132/is-it-safe-to-delete-bundle-files.html
And this post for the var\run version:
https://answers.splunk.com/answers/1397/how-long-should-bundle-tar-files-persist-in-the-search-head-...