https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-solve-the-Accelerated-Data-Model-Search-Problem-in-Splunk/m-p/372329#M45048 <P>can confirm, data model acceleration is at 100%. sourcetype=* was chosen as sourcetype=bluecoat wasn't working and wanted to see if any of the other sourcetypes were present in the search results.</P> Thu, 22 Mar 2018 16:03:54 GMT MikeElliott 2018-03-22T16:03:54Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-solve-the-Accelerated-Data-Model-Search-Problem-in-Splunk/m-p/372327#M45046 <P>Hi Team,</P> <P>I have recently mapped new sourcetypes to the Web data model, however, when searching using tstats, none of the new sourcetypes are returned in the search results. </P> <P>When I run the below search, I can see that data from my websense, squid and bluecoat proxies are present in the data model</P> <PRE><CODE>| datamodel Web Web search | search * | stats count by index, sourcetype | sort -count </CODE></PRE> <P>However, when attempting to search the data model using tstats, only websense and squid show up in the search results.</P> <PRE><CODE>| tstats summariesonly=t prestats=f count from datamodel=Web.Web WHERE sourcetype=* BY sourcetype Web.src Web.site Web.dest Web.url | dedup sourcetype </CODE></PRE> <P>Does anyone have any ideas what has gone wrong?</P> Thu, 22 Mar 2018 14:15:01 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-solve-the-Accelerated-Data-Model-Search-Problem-in-Splunk/m-p/372327#M45046 MikeElliott 2018-03-22T14:15:01Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-solve-the-Accelerated-Data-Model-Search-Problem-in-Splunk/m-p/372328#M45047 <P>is the acceleration completed? and if your are doing by sourcetype why sourcetype=*, is sourcetype field has null values?</P> Thu, 22 Mar 2018 14:22:22 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-solve-the-Accelerated-Data-Model-Search-Problem-in-Splunk/m-p/372328#M45047 p_gurav 2018-03-22T14:22:22Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-solve-the-Accelerated-Data-Model-Search-Problem-in-Splunk/m-p/372329#M45048 <P>can confirm, data model acceleration is at 100%. sourcetype=* was chosen as sourcetype=bluecoat wasn't working and wanted to see if any of the other sourcetypes were present in the search results.</P> Thu, 22 Mar 2018 16:03:54 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-solve-the-Accelerated-Data-Model-Search-Problem-in-Splunk/m-p/372329#M45048 MikeElliott 2018-03-22T16:03:54Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-solve-the-Accelerated-Data-Model-Search-Problem-in-Splunk/m-p/372330#M45049 <P>I had this issue </P> <P>A data model names Web that includes my WAF source type <BR /> I created another DM named after my WAF, this caused my WAF not to show in the results as a sourcetype when querying the Web DM </P> <P>So i removed the created DM and it worked again </P> Mon, 21 Jan 2019 15:29:35 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-solve-the-Accelerated-Data-Model-Search-Problem-in-Splunk/m-p/372330#M45049 aamer86 2019-01-21T15:29:35Z