https://community.splunk.com/t5/Splunk-Enterprise-Security/Datamodel-Child-object-not-accelerated/m-p/491562#M8361 <P>We created a child object within the authentication datamodel.<BR /> The authentication datamodel is accelerated, when searching the data using summariesonly=t we get data from the root and other childs but not from the child that we created. If we do not use summariesonly=t then we do see data.</P> <P>As a test i cloned the entire authentication datamodel and accelerated it and then i am able to use summariesonly=t.</P> <P>What we have tried:<BR /> - Rebuild the original authentication datamodel<BR /> - Clone the datamodel (works)<BR /> - Remove the child object and add it again. </P> <P>The search we are using:</P> <PRE><CODE>| tstats summariesonly=t count from datamodel=Authentication_test where nodename=Authentication.Login_Interactive </CODE></PRE> <P>The only difference i can find is that the original datamodel is in Splunk_SA_CIM and the cloned datamodel is in SplunkEnterpriseSecuritySuite. If anyone has an idea how to get the child element accelerated in the original authentication model i would be a happy splunker.</P> Wed, 30 Sep 2020 02:21:42 GMT MattibergB 2020-09-30T02:21:42Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Datamodel-Child-object-not-accelerated/m-p/491562#M8361 <P>We created a child object within the authentication datamodel.<BR /> The authentication datamodel is accelerated, when searching the data using summariesonly=t we get data from the root and other childs but not from the child that we created. If we do not use summariesonly=t then we do see data.</P> <P>As a test i cloned the entire authentication datamodel and accelerated it and then i am able to use summariesonly=t.</P> <P>What we have tried:<BR /> - Rebuild the original authentication datamodel<BR /> - Clone the datamodel (works)<BR /> - Remove the child object and add it again. </P> <P>The search we are using:</P> <PRE><CODE>| tstats summariesonly=t count from datamodel=Authentication_test where nodename=Authentication.Login_Interactive </CODE></PRE> <P>The only difference i can find is that the original datamodel is in Splunk_SA_CIM and the cloned datamodel is in SplunkEnterpriseSecuritySuite. If anyone has an idea how to get the child element accelerated in the original authentication model i would be a happy splunker.</P> Wed, 30 Sep 2020 02:21:42 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Datamodel-Child-object-not-accelerated/m-p/491562#M8361 MattibergB 2020-09-30T02:21:42Z