topic Re: Trying to accelerate data model, never stops building in Reporting

Trying to accelerate data model, never stops building

mjones414 — Thu, 31 Oct 2013 16:42:32 GMT

I've been trying to build a 7 day data model and have yet to successfully get the acceleration progress to move beyond building. The buckets and size are always 0 and its been over 15 hours. How can I troubleshoot the acceleration and identify what the problem is?

Re: Trying to accelerate data model, never stops building

aneels_splunk — Thu, 31 Oct 2013 17:24:41 GMT

There are a number of things that might be going on here. Does your data model contain event-based objects? Splunk only accelerated the first event-based object in a model, and its descendants. Search-based and Transaction-based objects can't be accelerated. (See the docs for more info.)

If you haven't already, you can also try disabling acceleration, making a trivial edit on your data model (e.g. add a field via eval) and then re-enabling. This ought to reset the acceleration.

Re: Trying to accelerate data model, never stops building

mjones414 — Thu, 31 Oct 2013 17:40:33 GMT

So then, if I were to accelerate different types of data that come from the same indexes, this becomes problematic because I have to add all the Auto-Extracted events to the root event and manually hide each one on the child events because auto-extracted is greyed out on child events.

Wouldnt that ultimately make a data storage nightmare for me if I were to break these indexes out multiple times in their own data models just because I want them accelerated?