Community:SplunkLockFiles

There are a few different lock files in the splunk system. Knowing what they are for can be important for diagnostic purposes.

• Bucket-locks

A bucket lock looks like /opt/splunk/var/lib/splunk/audit/hot_v1_4.lock

Buckets are locked by online fsck, the delete search operation, bucket mover, and other operations that modify buckets after the hot phase. The locking provides exclusion between these tools so that they don't step on each other.

Locked buckets remain searchable at all times.

Lock files of this sort are removed when the relevant program/task finishes.

• TSIDX locks

A tsidx lock looks like whatever.tsidx.lock

tsidx lockfiles are created by splunk-optimize when merging .tsidx files so that only one splunk-optimize will merge a given .tsidx file at a time. These are specific only to splunk-optimize. If a hot bucket contains many tsidx files and especially many locked tsidx files, it usually means that filesystem I/O is too slow for your workload.

There used to be some index-level or global locks, which I can only barely remember. Please update with current info.