All Apps and Add-ons

How to manage DataModel acceleration storage (tstatsHomePath) ?

ruiaires
Path Finder

Is there a way to manage the storage limits on the tstatsHomePath for an index that is using Data Model acceleration ?

I've installed the latest version of the Splunk for PaloAlto Networks that uses Splunk 6 DataModels instead of the TSCollect technique (which btw had the same problem) and right now I have 100GB in the datamodel_summary folder (and growing fast).

1 Solution

btorresgil
Builder

You can change the limits in the datamodel settings. The default for the Palo Alto Networks app is 1 year of data summarized, but you can adjust it down to months or days using these steps:

  • Goto the Splunk for Palo Alto Networks App
  • In the top right, click "Settings" -> "Data Models"
  • For the "Palo Alto Networks Logs" data model, click "Edit" -> "Edit Acceleration"
  • Change the "Summary Range" from "1 Year" to your desired value.

Note that the dashboards in the app use accelerated data, so this setting defines the timerange available in the dashboards.

View solution in original post

ben_leung
Builder

The PAN app did not consider larger amounts of data being collected. We have 1 day acceleration and the file system has already surpassed 300GB.

0 Karma

btorresgil
Builder

You can change the limits in the datamodel settings. The default for the Palo Alto Networks app is 1 year of data summarized, but you can adjust it down to months or days using these steps:

  • Goto the Splunk for Palo Alto Networks App
  • In the top right, click "Settings" -> "Data Models"
  • For the "Palo Alto Networks Logs" data model, click "Edit" -> "Edit Acceleration"
  • Change the "Summary Range" from "1 Year" to your desired value.

Note that the dashboards in the app use accelerated data, so this setting defines the timerange available in the dashboards.

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...