https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-App-for-Enterprise-Security-Network-Resolution-Data-Model/m-p/150252#M584 <P>Is there any information in the ES datamodel audit dashboard ?<BR /> Does all other datamodel are working well ?<BR /> What are your hardware spec and your volume of data indexed per day ?</P> Wed, 24 Jun 2015 21:31:23 GMT mdessus_splunk 2015-06-24T21:31:23Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-App-for-Enterprise-Security-Network-Resolution-Data-Model/m-p/150251#M583 <P>The only error I can find which seems relevant is this:</P> <PRE><CODE>06-12-2015 11:21:59.013 -0600 INFO SavedSplunker - savedsearch_id="nobody;Splunk_SA_CIM;_ACCELERATE_DM_Splunk_SA_CIM_Network_Resolution_ACCELERATE_", user="nobody", app="Splunk_SA_CIM", savedsearch_name="_ACCELERATE_DM_Splunk_SA_CIM_Network_Resolution_ACCELERATE_", status=skipped, reason="maxAutosummary limit reached", scheduled_time=1434129420 </CODE></PRE> <P>However, I cannot find any details on maxAutoSummary limited reached.</P> Fri, 12 Jun 2015 17:47:19 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-App-for-Enterprise-Security-Network-Resolution-Data-Model/m-p/150251#M583 shaung 2015-06-12T17:47:19Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-App-for-Enterprise-Security-Network-Resolution-Data-Model/m-p/150252#M584 <P>Is there any information in the ES datamodel audit dashboard ?<BR /> Does all other datamodel are working well ?<BR /> What are your hardware spec and your volume of data indexed per day ?</P> Wed, 24 Jun 2015 21:31:23 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-App-for-Enterprise-Security-Network-Resolution-Data-Model/m-p/150252#M584 mdessus_splunk 2015-06-24T21:31:23Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-App-for-Enterprise-Security-Network-Resolution-Data-Model/m-p/150253#M585 <P>I know it is a bit late but for those that have the same problem and land on this page (like myself):<BR /> The problem setting is "auto_summary_perc" in limits.conf <BR /> From docs:</P> <PRE><CODE>auto_summary_perc = &lt;integer&gt; * The maximum number of concurrent searches to be allocated for auto summarization, as a percentage of the concurrent searches that the scheduler can run. * Auto summary searches include: * Searches which generate the data for the Report Acceleration feature. * Searches which generate the data for Data Model acceleration. * Note: user scheduled searches take precedence over auto summary searches. * Defaults to 50. </CODE></PRE> Tue, 29 Sep 2020 08:06:53 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-App-for-Enterprise-Security-Network-Resolution-Data-Model/m-p/150253#M585 aholzel 2020-09-29T08:06:53Z