Remove datamodel summary from indexers

[viku7474]

We see around 100GB of datamodel_summary piled up on our cluster indexers from palo alto logs. 

We have now reduced the acceleration to 1 day.

Now we want to clear up the disk space on the indexers. Is it safe to remove datamodel_summary from the indexers?  Also, I see that those will not replicate among other indexers in cluster. So I plan to remove it manually from all the indexers in cluster. 

[PrewinThomas]

@viku7474 

Yes you can remove datamodel_summary directories if you need to reclaim disk space. These directories only contain accelerated summaries of data models, so deleting them won’t cause data loss. The only impact is that splunk will need to rebuild the summaries the next time an accelerated data model is queried, which may temporarily slow down searches until the summaries are regenerated.

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[PickleRick]

It's not exactly like that. 

When you use summariesonly=true if you don't have DAS prebuilt for the timerange requested by search it will only return data for the time you have data for. If you don't use it, it will not "rebuild" anything but will search from raw data when it doesn't have DAS coverage. DAS are built and updated on schedule, not on search.