Splunk SOAR (f.k.a. Phantom)

How can I check on PG side what is consuming more space in the database?

victor_menezes
Path Finder

Hi guys,

I'm trying to isolate what is being responsible for most of the data size on phantom. My data/db/base folder is huge and it keeps growing even though the logging level is really low and the vault is not something that I often use.

/opt/phantom/data]$ du -hsx * | sort -rh | head -10 | grep db
2.6T db

Is there any way for me to query and see what is consuming much space and maybe delete some old stuff?

I know that Phantom has those scripts to remove containers and etc but I personally don't think containers are the bad guys in this context, and the way it is I don't have like double the space available to do a Vacuum if I delete them all.

Thanks!

Tags (5)
0 Karma

phanTom
SplunkTrust
SplunkTrust

@victor_menezes there are lots of things that can cause the DB to be large, usually action_run/playbook_run/artifact/audit tables are very large.

First, you should setup data retention policies if not done already (docs link) as this should keep the database trimmed. 

I have seen DBs of similar and larger sizes for heavily used installations. What's your setup and how any events do you currently have on the platform?

The only other way would be to interact with the DB to trim tables but ofcourse I would 100% recommend engaging with support before deviating from established ways to manage DB capacity. 

 

-- Hope this helps! If so please mark as a solution! Happy SOARing! --

paulcurry
Path Finder

Would ingestion summary help?  I haven't used Phantom in a long time so I may be totally off base.

System Health > Ingestion Summary.

0 Karma

victor_menezes
Path Finder

Not really. That's just an overall count of ingested events.

I'm looking more at the DB level because I suspect that there is something "stuck" in DB side, so something like table sizes and etc.

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...