All Apps and Add-ons

How to manage DataModel acceleration storage (tstatsHomePath) ?

Path Finder

Is there a way to manage the storage limits on the tstatsHomePath for an index that is using Data Model acceleration ?

I've installed the latest version of the Splunk for PaloAlto Networks that uses Splunk 6 DataModels instead of the TSCollect technique (which btw had the same problem) and right now I have 100GB in the datamodel_summary folder (and growing fast).

1 Solution

Builder

You can change the limits in the datamodel settings. The default for the Palo Alto Networks app is 1 year of data summarized, but you can adjust it down to months or days using these steps:

  • Goto the Splunk for Palo Alto Networks App
  • In the top right, click "Settings" -> "Data Models"
  • For the "Palo Alto Networks Logs" data model, click "Edit" -> "Edit Acceleration"
  • Change the "Summary Range" from "1 Year" to your desired value.

Note that the dashboards in the app use accelerated data, so this setting defines the timerange available in the dashboards.

View solution in original post

Builder

The PAN app did not consider larger amounts of data being collected. We have 1 day acceleration and the file system has already surpassed 300GB.

0 Karma

Builder

You can change the limits in the datamodel settings. The default for the Palo Alto Networks app is 1 year of data summarized, but you can adjust it down to months or days using these steps:

  • Goto the Splunk for Palo Alto Networks App
  • In the top right, click "Settings" -> "Data Models"
  • For the "Palo Alto Networks Logs" data model, click "Edit" -> "Edit Acceleration"
  • Change the "Summary Range" from "1 Year" to your desired value.

Note that the dashboards in the app use accelerated data, so this setting defines the timerange available in the dashboards.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!