Getting Data In

tstatsHomePath must remain unset but default indexes.conf has the attribute configured.

dm1
Contributor

As per the Smartstore docs, tstatsHomePath must remain unset but I noticed the /default/indexes.conf on 8.1.5 version, the value of tstatsHomePath attribute is already set as shown in screenshot below:

2222.PNGI have also noticed /opt/splunk/var/lib/splunk/index_name/datamodel_summary having numerous large files. Not sure if its to do with the tstatsHomePath attribute being set.

Should I add the following in /local/indexes.conf ?

tstatsHomePath =

 

Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

To be honest this is little bite confusing in docs, after I read this again. I just sent questions about what this really meaning to doc team. Usually they are answering quite soon. Let's see what they are saying.

 

tstatsHomePath = <string>
* Location where data model acceleration TSIDX data for this index should be stored.
* Required.
* MUST be defined in terms of a volume definition (see volume section below)
* Path must be writable.
* You must not set this setting for remote storage enabled indexes.
* You must restart splunkd after changing this setting for the
  changes to take effect. Reloading the index configuration does
  not suffice.
* Default: volume:_splunk_summaries/$_index_name/datamodel_summary,
  where "$_index_name" is runtime-expanded to the name of the index

 Based on Required and You must not set this.... this is confusing.

r. Ismo

0 Karma

dm1
Contributor

Yes, and because I left the default settings as it is, all datamodel summary data is getting stored and consuming space in the local drive (/) which does not have sufficient space. I thought after smartstore is configured, all summary data goes to S3

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...