How to manage DataModel acceleration storage (tstatsHomePath) ?

[ruiaires]

Is there a way to manage the storage limits on the tstatsHomePath for an index that is using Data Model acceleration ?

I've installed the latest version of the Splunk for PaloAlto Networks that uses Splunk 6 DataModels instead of the TSCollect technique (which btw had the same problem) and right now I have 100GB in the datamodel_summary folder (and growing fast).

[ben_leung]

The PAN app did not consider larger amounts of data being collected. We have 1 day acceleration and the file system has already surpassed 300GB.

[btorresgil · Accepted solution]

You can change the limits in the datamodel settings. The default for the Palo Alto Networks app is 1 year of data summarized, but you can adjust it down to months or days using these steps:

• Goto the Splunk for Palo Alto Networks App
• In the top right, click "Settings" -> "Data Models"
• For the "Palo Alto Networks Logs" data model, click "Edit" -> "Edit Acceleration"
• Change the "Summary Range" from "1 Year" to your desired value.

Note that the dashboards in the app use accelerated data, so this setting defines the timerange available in the dashboards.