Hello,
I am trying to disable ALL possible accelerating data models pertaining to the Splunk for Palo Alto Networks app within Splunk Enterprise 6.2.6. I have already disabled the data model acceleration in the GUI and have verified the local datamodels.conf has acceleration disabled but the datamodel_summary directory is being recreated again. I have seen over 600GB in this directory and have no use for the acceleration so i would prefer the storage space over the acceleration.
[pan_endpoint]
acceleration = 0
[pan_wildfire_report]
acceleration = 0
[pan_firewall]
acceleration = 0
Thanks,
Chris
... View more