<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Can accelerated data models work with summarized data? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Can-accelerated-data-models-work-with-summarized-data/m-p/639540#M109200</link>
    <description>&lt;P&gt;Can accelerated data models handle pre-summarized data accurately?&amp;nbsp; Take authentication messages for example.&amp;nbsp; Most apps and operating systems will send one message per authentication attempt.&amp;nbsp; But I've seen some solutions that will send a digest every five minutes or whatever showing the count of success/failed messages by user.&lt;BR /&gt;&lt;BR /&gt;Are there settings that control how accelerated data models calculate the "count" if the messages contain a "count=X" field in it?&amp;nbsp; And if so, can an accelerated data model handle a blend of raw and summarized events?&lt;/P&gt;</description>
    <pubDate>Tue, 11 Apr 2023 18:46:44 GMT</pubDate>
    <dc:creator>responsys_cm</dc:creator>
    <dc:date>2023-04-11T18:46:44Z</dc:date>
    <item>
      <title>Can accelerated data models work with summarized data?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Can-accelerated-data-models-work-with-summarized-data/m-p/639540#M109200</link>
      <description>&lt;P&gt;Can accelerated data models handle pre-summarized data accurately?&amp;nbsp; Take authentication messages for example.&amp;nbsp; Most apps and operating systems will send one message per authentication attempt.&amp;nbsp; But I've seen some solutions that will send a digest every five minutes or whatever showing the count of success/failed messages by user.&lt;BR /&gt;&lt;BR /&gt;Are there settings that control how accelerated data models calculate the "count" if the messages contain a "count=X" field in it?&amp;nbsp; And if so, can an accelerated data model handle a blend of raw and summarized events?&lt;/P&gt;</description>
      <pubDate>Tue, 11 Apr 2023 18:46:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Can-accelerated-data-models-work-with-summarized-data/m-p/639540#M109200</guid>
      <dc:creator>responsys_cm</dc:creator>
      <dc:date>2023-04-11T18:46:44Z</dc:date>
    </item>
    <item>
      <title>Re: Can accelerated data models work with summarized data?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Can-accelerated-data-models-work-with-summarized-data/m-p/639551#M109202</link>
      <description>&lt;P&gt;No, there is no way to handle data like this other than to break the event into 'count' singleton events.&amp;nbsp; You could basteridze one of the other fields that already exist, such as `duration` or `response_time` but whatever you do, do NOT modify the datamodel itself (you will eventually have much pain and regret if you do).&lt;/P&gt;</description>
      <pubDate>Tue, 11 Apr 2023 20:15:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Can-accelerated-data-models-work-with-summarized-data/m-p/639551#M109202</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2023-04-11T20:15:26Z</dc:date>
    </item>
  </channel>
</rss>

