Getting Data In

tstatsHomePath must remain unset but default indexes.conf has the attribute configured.

dm1
Contributor

As per the Smartstore docs, tstatsHomePath must remain unset but I noticed the /default/indexes.conf on 8.1.5 version, the value of tstatsHomePath attribute is already set as shown in screenshot below:

2222.PNGI have also noticed /opt/splunk/var/lib/splunk/index_name/datamodel_summary having numerous large files. Not sure if its to do with the tstatsHomePath attribute being set.

Should I add the following in /local/indexes.conf ?

tstatsHomePath =

 

Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

To be honest this is little bite confusing in docs, after I read this again. I just sent questions about what this really meaning to doc team. Usually they are answering quite soon. Let's see what they are saying.

 

tstatsHomePath = <string>
* Location where data model acceleration TSIDX data for this index should be stored.
* Required.
* MUST be defined in terms of a volume definition (see volume section below)
* Path must be writable.
* You must not set this setting for remote storage enabled indexes.
* You must restart splunkd after changing this setting for the
  changes to take effect. Reloading the index configuration does
  not suffice.
* Default: volume:_splunk_summaries/$_index_name/datamodel_summary,
  where "$_index_name" is runtime-expanded to the name of the index

 Based on Required and You must not set this.... this is confusing.

r. Ismo

0 Karma

dm1
Contributor

Yes, and because I left the default settings as it is, all datamodel summary data is getting stored and consuming space in the local drive (/) which does not have sufficient space. I thought after smartstore is configured, all summary data goes to S3

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...