what is data in /opt/splunk/var/lib/splunk/msad/datamodel_summary

[aasabei]

Hi everyone,

  "/opt/splunk/var/lib/splunk/msad/datamodel_summary/     " is taking up the most space on the root volume   120G , and last modified date was 2 years ago. can i delete them  ? 

Best,

Amir

[richgalloway]

That directory is where the data from the msad index is stored data models. Since AD generates a lot of events, it's not surprising that DM is so large.
If you have accelerated data models that reference index=msad and you use that DM then you should not touch the directory.
If no DMs use the msad index then I'm surprised the data hasn't aged out under the index's retention settings.