https://community.splunk.com/t5/Splunk-Enterprise-Security/Does-Enterprise-Security-automatically-re-enable-data-model/m-p/161476#M669 <P>Yes, ES will automatically override DM acceleration state. This can be controlled under the "Data Inputs" manager UI. There's an entry called "Data Model Acceleration Enforcement" where this can be controlled on a more permanent basis.</P> <P>This is controlled via modular input called <CODE>dm_accel_settings</CODE> that will enforce these settings.</P> Thu, 18 Dec 2014 18:52:40 GMT Lowell 2014-12-18T18:52:40Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Does-Enterprise-Security-automatically-re-enable-data-model/m-p/161475#M668 <P>I'm trying to disable acceleration on a data model that's consuming a massive amount of memory on the indexers. All the correlation searches for this data model are disabled, and I'm fine with some of the related dashboards being slow or unavailable (if they use <CODE>tstats</CODE>, for example).</P> <P>I disabled acceleration and it was re-enabled a few hours later. So far no one has confessed to re-enabling it.</P> <P>So I'm wondering if there's some automatic "protect-you-from-yourself" functionality that turns acceleration back on automatically.</P> Thu, 18 Dec 2014 16:52:55 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Does-Enterprise-Security-automatically-re-enable-data-model/m-p/161475#M668 Lowell 2014-12-18T16:52:55Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Does-Enterprise-Security-automatically-re-enable-data-model/m-p/161476#M669 <P>Yes, ES will automatically override DM acceleration state. This can be controlled under the "Data Inputs" manager UI. There's an entry called "Data Model Acceleration Enforcement" where this can be controlled on a more permanent basis.</P> <P>This is controlled via modular input called <CODE>dm_accel_settings</CODE> that will enforce these settings.</P> Thu, 18 Dec 2014 18:52:40 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Does-Enterprise-Security-automatically-re-enable-data-model/m-p/161476#M669 Lowell 2014-12-18T18:52:40Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Does-Enterprise-Security-automatically-re-enable-data-model/m-p/161477#M670 <P>do you know how to change it in a Clustered ES system? (coz via its not changeable)</P> Tue, 12 Apr 2016 14:55:46 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Does-Enterprise-Security-automatically-re-enable-data-model/m-p/161477#M670 koshyk 2016-04-12T14:55:46Z