Splunk 6.6.3, clustered env. One of our indexers reporting high disk usage. Traced it down to ```/opt/splunk/var/run/splunk/cluster/search-buckets``` containing many `search_sitedefault_gen*.csv.gz` and `summarize_sitedefault_gen*.csv.gz` files going back to 22 days ago (December 12 at this time). I deleted older ones to stop triggering our disk use alerts.
Whats creating these files and why?
↧