Solved: Reduce data model summaries

tkw03 · ‎06-15-2020

I have a data model that has grown quite large, over 7TB for Network Sessions. Its set to 3 months accelerated. I want to change it 7 days but I'm not sure it will remove the rest of the data summaries stored in storage. We only need 7 days of work of accelerated summaries.

Will me changing the timespan to reduce the number of summaries consuming storage?

Thanks for the assistance!

richgalloway · ‎06-15-2020

Yes, reducing the size of the summary will recover some disk space.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎06-15-2020

Yes, reducing the size of the summary will recover some disk space.

---
If this reply helps you, Karma would be appreciated.

Reduce data model summaries

administration

troubleshooting

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Join the Conversation