Getting Data In

tstatsHomePath must remain unset but default indexes.conf has the attribute configured.

dm1
Contributor

As per the Smartstore docs, tstatsHomePath must remain unset but I noticed the /default/indexes.conf on 8.1.5 version, the value of tstatsHomePath attribute is already set as shown in screenshot below:

2222.PNGI have also noticed /opt/splunk/var/lib/splunk/index_name/datamodel_summary having numerous large files. Not sure if its to do with the tstatsHomePath attribute being set.

Should I add the following in /local/indexes.conf ?

tstatsHomePath =

 

Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

To be honest this is little bite confusing in docs, after I read this again. I just sent questions about what this really meaning to doc team. Usually they are answering quite soon. Let's see what they are saying.

 

tstatsHomePath = <string>
* Location where data model acceleration TSIDX data for this index should be stored.
* Required.
* MUST be defined in terms of a volume definition (see volume section below)
* Path must be writable.
* You must not set this setting for remote storage enabled indexes.
* You must restart splunkd after changing this setting for the
  changes to take effect. Reloading the index configuration does
  not suffice.
* Default: volume:_splunk_summaries/$_index_name/datamodel_summary,
  where "$_index_name" is runtime-expanded to the name of the index

 Based on Required and You must not set this.... this is confusing.

r. Ismo

0 Karma

dm1
Contributor

Yes, and because I left the default settings as it is, all datamodel summary data is getting stored and consuming space in the local drive (/) which does not have sufficient space. I thought after smartstore is configured, all summary data goes to S3

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...