Knowledge Management

datamodel_summary directory in _internaldb - can we delete?

thezero
Path Finder

Hi Team,

datamodel_summary directory in _internaldb is consuming huge disk space nearly equivalent to hot DB. Can we delete it? From the documents description its understood that it's used for some kind of data acceleration.What will be the impact if I delete this directory from _internaldb? Do this directory used for any inbuilt app/feature? how can we disable it? please advise

Splunk version we r using -indexer -6.0.5.1

0 Karma
1 Solution

dshpritz
SplunkTrust
SplunkTrust

Hey thezero,

As you mentioned, the datamodel_summary directory contains accelerated data from datamodels. While you can delete it, that may not solve the issue, as if Splunk sees that a retention policy is not being met, it is just going to kick off accelerations, and the reclaim the disk space. Your best bet would be to figure out which data model is causing the issue, and then adjusting it as needed.

Under "Settings" check out the "Data Models" page, and look for accelerated data models that may be contributing to the disk space usage. If you don't find any, then it is possible that there was an accelerated data model at one time, but it has since been removed, and Splunk hasn't reaped the accelerations, in which case you can delete that directory.

Hope this helps,

Dave

View solution in original post

rpizano
New Member

You can attach storage or increase disk space and create a separate partition and do the following,

  1. shut down splunk
  2. move data to new partition or storage
  3. create a symbolic link in the original directory to point to the new storage location
  4. start splunk
  5. Have a coke, youre done!
0 Karma

kenxu
New Member

is it any way can chang datamodel_summar path?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can change tstatsHomePath in indexes.conf, but please do open a new question if you have a new question.

dshpritz
SplunkTrust
SplunkTrust

Hey thezero,

As you mentioned, the datamodel_summary directory contains accelerated data from datamodels. While you can delete it, that may not solve the issue, as if Splunk sees that a retention policy is not being met, it is just going to kick off accelerations, and the reclaim the disk space. Your best bet would be to figure out which data model is causing the issue, and then adjusting it as needed.

Under "Settings" check out the "Data Models" page, and look for accelerated data models that may be contributing to the disk space usage. If you don't find any, then it is possible that there was an accelerated data model at one time, but it has since been removed, and Splunk hasn't reaped the accelerations, in which case you can delete that directory.

Hope this helps,

Dave

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...