Why does data model acceleration cause a field alias to stop working?

andrewtrobec — Thu, 06 Jul 2017 15:01:58 GMT

Hello,
I'm working with Splunk 6.4.1. I have an accelerated data model with calculated fields, and aliases configured to map index fields to the data model calculated fields. I recently had to add a new calculated field to the data model, so I disabled the acceleration, added the field, and then created a new field alias. Everything works as expected. When I re-enable the data model acceleration, however, I've noticed, that the field aliases don't work anymore. For the time being I've disabled data model acceleration. How do I get the alias to work with data model acceleration enabled?
Regards,
Andrew

Re: Why does data model acceleration cause a field alias to stop working?

jacobpevans — Mon, 08 Jul 2019 18:50:31 GMT

I have the same issue. I found this tip on a related question: https://answers.splunk.com/answers/700613/some-events-missing-from-data-model-only-if-accele.html, specifically:

Please edit/create the file $SPLUNK_HOME/etc/system/local/limits.conf .
Add the following stanza

[directives]
read_summary = disabled

Restart the instance for changes to take effect.
In a distributed env it should be done on the SH.

The setting is defined as follows on Splunk Docs (https://docs.splunk.com/Documentation/Splunk/latest/Admin/LimitsConf):

read_summary = enabled|disabled

* Enables the use of the read summary directive, which allows the search
  processor to leverage existing data model acceleration summary data when it
  performs event searches.
* Disable this setting only to troubleshoot issues with search results.
* Default: true

topic Why does data model acceleration cause a field alias to stop working? in Knowledge Management

Why does data model acceleration cause a field alias to stop working?

Re: Why does data model acceleration cause a field alias to stop working?