topic tstatsHomePath must remain unset but default indexes.conf has the attribute configured. in Getting Data In

tstatsHomePath must remain unset but default indexes.conf has the attribute configured.

dm1 — Thu, 20 Jan 2022 05:05:47 GMT

As per the Smartstore docs, tstatsHomePath must remain unset but I noticed the /default/indexes.conf on 8.1.5 version, the value of tstatsHomePath attribute is already set as shown in screenshot below:

I have also noticed /opt/splunk/var/lib/splunk/index_name/datamodel_summary having numerous large files. Not sure if its to do with the tstatsHomePath attribute being set.

Should I add the following in /local/indexes.conf ?

tstatsHomePath =

Re: tstatsHomePath must remain unset but default indexes.conf has the attribute configured.

isoutamo — Thu, 20 Jan 2022 07:11:00 GMT

To be honest this is little bite confusing in docs, after I read this again. I just sent questions about what this really meaning to doc team. Usually they are answering quite soon. Let's see what they are saying.

tstatsHomePath = <string>
* Location where data model acceleration TSIDX data for this index should be stored.
* Required.
* MUST be defined in terms of a volume definition (see volume section below)
* Path must be writable.
* You must not set this setting for remote storage enabled indexes.
* You must restart splunkd after changing this setting for the
  changes to take effect. Reloading the index configuration does
  not suffice.
* Default: volume:_splunk_summaries/$_index_name/datamodel_summary,
  where "$_index_name" is runtime-expanded to the name of the index

Based on Required and You must not set this.... this is confusing.

r. Ismo

Re: tstatsHomePath must remain unset but default indexes.conf has the attribute configured.

dm1 — Thu, 20 Jan 2022 23:08:31 GMT

Yes, and because I left the default settings as it is, all datamodel summary data is getting stored and consuming space in the local drive (/) which does not have sufficient space. I thought after smartstore is configured, all summary data goes to S3