Suricata 4.0.6, /data/suricata/eve.json files too large

Good afternoon,

Our eve-*.json files have grown to be very large, so much so that its filled our /data/suricata directory and has subsequently caused any and all suricata and splunk services on the device to stop. Additionally the device has become unable to be SSH’d into.

For example, here are the sizes:
1.6T eve-dnsnt80.json
48G eve-ids-attacknt80.json
15G eve-statsnt80.json
12G eve-statsnt40.json

Are any of these safe to delete?
Additionally, how can we manage these .json files better in the future? Can a cron job be made to delete these logs routinely?

I apologize if this doesn’t make too much sense, I am still very new to Suricata.

Please see the documentation on log rotation: 17.6. Log Rotation — Suricata 8.0.0-dev documentation

Suricata 6 and 7 do contain a template that can be used for reference in the ./etc/ directory.

Please note that Suricata 4 was end of life in 2019 and is no longer supported.