topic Re: How can I enable inactive data models? in Splunk Enterprise

How can I enable inactive data models?

DanAlexander — Tue, 13 Sep 2022 13:37:03 GMT

Morning all,

I am new to Data Models and wanted some guidance of how I can enable some of the inactive ones. Is acceleration available after the Data Model is activated. I am confused with acceleration and how to enable a Data Model. I just want to enable our Endpoint Data Model as we are gaining logs from Universal Forwarder and Sysmon as well. Wanted to find some useful Endpoint use cases I can start using.

Any help much appreciated!

Thank you!

Re: How can I enable inactive data models?

richgalloway — Tue, 13 Sep 2022 15:49:22 GMT

I'm not sure what you mean by "inactive" and "active" with regard to data models. That's not a term I've seen used in that context. Likewise with "enabled". If a data model exists then it's enabled.

Data model acceleration (DMA) is another matter. DMA can be enabled in the Settings->Data models page. Chose "Edit Acceleration" from the Edit menu of the appropriate data model.