Where are Splunk Data Model Acceleration (DMA) summaries stored?

Question

Options

• AIn tstatsHomePath
• BIn the .tsidx files.
• CIn summaryHomePath
• DIn journal.gz

• A
  89% (31)
• B
  3% (1)
• C
  3% (1)
• D
  6% (2)

Explanation

Splunk Data Model Acceleration summaries are stored in the path defined by tstatsHomePath, a setting in indexes.conf that tells Splunk where to write the accelerated summary data for each index. This path holds the .tsidx files and bucket metadata that make tstats searches fast.

• B is wrong because .tsidx is the file format of the summaries, not the storage location - those files live inside tstatsHomePath.
• C is wrong because summaryHomePath is used for report acceleration (summary indexing), a completely different feature from data model acceleration.
• D is wrong because journal.gz files hold the raw compressed event data in a normal Splunk index - unrelated to DMA.

Memory tip: The tstats command is what you run against accelerated data models, so tstatsHomePath is simply "where the tstats data lives" - the name maps directly to the command that uses it.

No community discussion yet for this question.