Data model not accelerating data older than a year

sarit_s — Mon, 09 Nov 2020 11:49:33 GMT

Hello
i have data model acceleration configured for all time.

i have data indexed for 16 months but when im running my query with

summariesonly=true

im getting less results than when im running

summariesonly=false

and the latest data is a year ago

also, i see this error msg in the data model page :

Error in data model "events_prod" : JSON file contents not available.

i don't know if it is related or not ...

i couldn't find any errors in the logs

i've added to datamodels.conf this stanza:

acceleration.allow_skew = 100%

but it didn't help.

any suggestion ?

thanks

sarit

topic Data model not accelerating data older than a year in Splunk Dev