Archive

datamodel_summary directory in _internaldb - can we delete?

Path Finder

Hi Team,

datamodel_summary directory in _internaldb is consuming huge disk space nearly equivalent to hot DB. Can we delete it? From the documents description its understood that it's used for some kind of data acceleration.What will be the impact if I delete this directory from _internaldb? Do this directory used for any inbuilt app/feature? how can we disable it? please advise

Splunk version we r using -indexer -6.0.5.1

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hey thezero,

As you mentioned, the datamodel_summary directory contains accelerated data from datamodels. While you can delete it, that may not solve the issue, as if Splunk sees that a retention policy is not being met, it is just going to kick off accelerations, and the reclaim the disk space. Your best bet would be to figure out which data model is causing the issue, and then adjusting it as needed.

Under "Settings" check out the "Data Models" page, and look for accelerated data models that may be contributing to the disk space usage. If you don't find any, then it is possible that there was an accelerated data model at one time, but it has since been removed, and Splunk hasn't reaped the accelerations, in which case you can delete that directory.

Hope this helps,

Dave

View solution in original post

New Member

You can attach storage or increase disk space and create a separate partition and do the following,

  1. shut down splunk
  2. move data to new partition or storage
  3. create a symbolic link in the original directory to point to the new storage location
  4. start splunk
  5. Have a coke, youre done!
0 Karma

New Member

is it any way can chang datamodel_summar path?

0 Karma

SplunkTrust
SplunkTrust

You can change tstatsHomePath in indexes.conf, but please do open a new question if you have a new question.

SplunkTrust
SplunkTrust

Hey thezero,

As you mentioned, the datamodel_summary directory contains accelerated data from datamodels. While you can delete it, that may not solve the issue, as if Splunk sees that a retention policy is not being met, it is just going to kick off accelerations, and the reclaim the disk space. Your best bet would be to figure out which data model is causing the issue, and then adjusting it as needed.

Under "Settings" check out the "Data Models" page, and look for accelerated data models that may be contributing to the disk space usage. If you don't find any, then it is possible that there was an accelerated data model at one time, but it has since been removed, and Splunk hasn't reaped the accelerations, in which case you can delete that directory.

Hope this helps,

Dave

View solution in original post