topic Re: Splunk DataModel Acceleration High Run time Issue in Splunk Enterprise Security

Splunk DataModel Acceleration High Run time Issue

zacksoft_wf — Thu, 02 Sep 2021 10:27:12 GMT

Out of the dataModels provided with Enterprise Security, one of the accelerated datamodel suddenly has a very high run time than usual . Any suggestion for what could be the issue Or where in the internal logs we should see to identify potential root cause for it ?

Re: Splunk DataModel Acceleration High Run time Issue

PickleRick — Thu, 02 Sep 2021 10:43:36 GMT

You mean searching from datamodel is slow or building summary is slow?

If the former - someone disabled acceleration?

If the latter - didn't the datamodel change recently? Changing definition of datasets requires rebuilding of summaries.

Or maybe you suddenly just have much more data?

Re: Splunk DataModel Acceleration High Run time Issue

zacksoft_wf — Thu, 02 Sep 2021 10:47:57 GMT

@PickleRick
It is the later (Building Summary is slow).
I am not sure if anyone has changed the definition lately.
However , if I perform a 'rebuild', will that have any adverse effect on the dataModel (like missing data , incorrect data..etc..?)

Re: Splunk DataModel Acceleration High Run time Issue

PickleRick — Thu, 02 Sep 2021 11:00:33 GMT

Well, in theory, rebuilding should just rebuild the summary data from the index contents for a given range.

But it will be slow if you have lots of data.

Typically you define datasets early on when you don't have much data and the summaries are updated incrementaly using defined schedule (usually 5 minutes or so). If you decide to suddenly rebuild summaries for - let's say - 3 months back and it turns out that you have several terabytes of data to analyze... well, that can be painful for the indexers.

Re: Splunk DataModel Acceleration High Run time Issue

zacksoft_wf — Thu, 02 Sep 2021 11:44:21 GMT

Is there a way, to know if there is a change in data Model definition ?
I'm trying to figure out the high run time issue, why the acceleration is taking time !

Btw - pickleRick is the coolest user name ever. 🙂

Re: Splunk DataModel Acceleration High Run time Issue

PickleRick — Thu, 02 Sep 2021 12:10:08 GMT

I'm not really sure but short of having historic dumps of your configs and comparing with old revisions... I don't see any possibility. Maybe change of definitions triggers some entry in the logs but I'm not sure here.