Is there a way to manage the storage limits on the tstatsHomePath for an index that is using Data Model acceleration ?
I've installed the latest version of the Splunk for PaloAlto Networks that uses Splunk 6 DataModels instead of the TSCollect technique (which btw had the same problem) and right now I have 100GB in the datamodel_summary folder (and growing fast).
You can change the limits in the datamodel settings. The default for the Palo Alto Networks app is 1 year of data summarized, but you can adjust it down to months or days using these steps:
Note that the dashboards in the app use accelerated data, so this setting defines the timerange available in the dashboards.
The PAN app did not consider larger amounts of data being collected. We have 1 day acceleration and the file system has already surpassed 300GB.
You can change the limits in the datamodel settings. The default for the Palo Alto Networks app is 1 year of data summarized, but you can adjust it down to months or days using these steps:
Note that the dashboards in the app use accelerated data, so this setting defines the timerange available in the dashboards.