datamodel_summary directory in _internaldb - can we delete?

[thezero]

Hi Team,

datamodel_summary directory in _internaldb is consuming huge disk space nearly equivalent to hot DB. Can we delete it? From the documents description its understood that it's used for some kind of data acceleration.What will be the impact if I delete this directory from _internaldb? Do this directory used for any inbuilt app/feature? how can we disable it? please advise

Splunk version we r using -indexer -6.0.5.1

[rpizano]

You can attach storage or increase disk space and create a separate partition and do the following,

1. shut down splunk
2. move data to new partition or storage
3. create a symbolic link in the original directory to point to the new storage location
4. start splunk
5. Have a coke, youre done!

[kenxu]

is it any way can chang datamodel_summar path?

[martin_mueller]

You can change tstatsHomePath in indexes.conf, but please do open a new question if you have a new question.

[dshpritz · Accepted solution]

Hey thezero,

As you mentioned, the datamodel_summary directory contains accelerated data from datamodels. While you can delete it, that may not solve the issue, as if Splunk sees that a retention policy is not being met, it is just going to kick off accelerations, and the reclaim the disk space. Your best bet would be to figure out which data model is causing the issue, and then adjusting it as needed.

Under "Settings" check out the "Data Models" page, and look for accelerated data models that may be contributing to the disk space usage. If you don't find any, then it is possible that there was an accelerated data model at one time, but it has since been removed, and Splunk hasn't reaped the accelerations, in which case you can delete that directory.

Hope this helps,

Dave