How to clear NSM partition usage?

[AnthonyKendall]

Hello everyone,

I am just trying to figure out how to clear up this NSM partition usage? I am at 81% and I tried the so-nsm-clear but that does not fully clear all of the data. So my question is, can I clear all of this data if possible to not have the drive fill up and if so how?

[cm-ops]

What type of node is this? If you have Elasticsearch data, you would want to set your ILM to delete data before filling your disk. Look at your indices and see how much retention you are currently getting to get a rough idea of when to set deletion. https://docs.securityonion.net/en/2.4/elasticsearch.html#ilm

If you have PCAP data in the case of a sensor or standalone node, you can set the diskfreepercentage to remove PCAP sooner. https://docs.securityonion.net/en/2.4/stenographer.html#disk-free-percentage

Is there other /nsm data you are looking to remove?