topic Re: data model acceleration in Splunk Dev

data model acceleration

sarit_s — Wed, 21 Oct 2020 10:05:14 GMT

Hello,

I have data model that i want to change the acceleration time to all time.

since im working with kubernetece the change has to be in the config files directly and not through the ui.

i saw in the documentation that empty string for

acceleration.earliest_time

means all time

but when i change this field to be empty, the configuration in the ui changed to be 1 day instead of all time as it should.

any ideas ?

thanks

Re: data model acceleration

richgalloway — Wed, 21 Oct 2020 12:53:58 GMT

Searching All Time rarely is a good idea, especially for datamodels. The goal of DMA is to make accessing your data faster in routine searches. One-off and non-routine searches usually can wait the extra time it takes to gather the data. Otherwise, you're putting extra work on your system to search (and store) more than is necessary.

What is the use case for having All Time data accelerated?

Re: data model acceleration

sarit_s — Wed, 21 Oct 2020 12:59:12 GMT

Well, its not permanent

we want to run some statistics over data older than a year