topic Data Model Acceleration Issue in ES Instance in Splunk Enterprise Security

Data Model Acceleration Issue in ES Instance

aydinmo — Thu, 28 Mar 2024 17:00:20 GMT

Hello Splunkers,

I'm encountering an issue with data model acceleration in my ES instance . A few weeks ago, I enabled several data models in my ES instance to support correlation searches. However, I recently noticed that there hasn't been any increase in SVC usage, and upon checking today, I found that the acceleration status for these models was disabled.

I'm puzzled by this and would appreciate any insights into why this occurred and how to identify the root cause.

Thank you.

Re: Data Model Acceleration Issue in ES Instance

meetmshah — Fri, 29 Mar 2024 07:08:04 GMT

Hello @aydinmo This could be because of Data Model Acceleration Enforcement.

What it does is, even if you turn DMA On/Off - it will enforce the default behaviour.

Can you please check the configurations from Settings -> Data Model Acceleration Enforcement Settings and Enable / Disable the default behaviour as required. Below screenshot for your reference -

Here is the Splunk Doc for your reference - https://docs.splunk.com/Documentation/ES/7.3.0/Install/Datamodels#Data_model_acceleration_enforcement

Please accept the solution and hit Karma, if this helps!

Re: Data Model Acceleration Issue in ES Instance

aydinmo — Mon, 01 Apr 2024 12:28:36 GMT

Thank you for the inputs. I checked and this is not the root cause. I need to identify the root cause to prevent such cases happening in the future.