Hi Team,
datamodel_summary directory in _internaldb is consuming huge disk space nearly equivalent to hot DB. Can we delete it? From the documents description its understood that it's used for some kind of data acceleration.What will be the impact if I delete this directory from _internaldb? Do this directory used for any inbuilt app/feature? how can we disable it? please advise
Splunk version we r using -indexer -6.0.5.1
Hey thezero,
As you mentioned, the datamodel_summary directory contains accelerated data from datamodels. While you can delete it, that may not solve the issue, as if Splunk sees that a retention policy is not being met, it is just going to kick off accelerations, and the reclaim the disk space. Your best bet would be to figure out which data model is causing the issue, and then adjusting it as needed.
Under "Settings" check out the "Data Models" page, and look for accelerated data models that may be contributing to the disk space usage. If you don't find any, then it is possible that there was an accelerated data model at one time, but it has since been removed, and Splunk hasn't reaped the accelerations, in which case you can delete that directory.
Hope this helps,
Dave
You can attach storage or increase disk space and create a separate partition and do the following,
is it any way can chang datamodel_summar path?
You can change tstatsHomePath
in indexes.conf, but please do open a new question if you have a new question.
Hey thezero,
As you mentioned, the datamodel_summary directory contains accelerated data from datamodels. While you can delete it, that may not solve the issue, as if Splunk sees that a retention policy is not being met, it is just going to kick off accelerations, and the reclaim the disk space. Your best bet would be to figure out which data model is causing the issue, and then adjusting it as needed.
Under "Settings" check out the "Data Models" page, and look for accelerated data models that may be contributing to the disk space usage. If you don't find any, then it is possible that there was an accelerated data model at one time, but it has since been removed, and Splunk hasn't reaped the accelerations, in which case you can delete that directory.
Hope this helps,
Dave