topic What is the data model acceleration default cron schedule? in Reporting

What is the data model acceleration default cron schedule?

the_wolverine — Mon, 27 Jul 2015 20:31:13 GMT

I have data model acceleration enabled and have seen that the data model is not keeping up with the raw data (my dashboards populated by tstats are not showing recent data and can be behind by 1 hour). The datamodels.conf stanzas do not contain a cron. So I'm wondering if there is a default schedule is being used -- and if so -- what is is that schedule?

According to data models.conf.spec:

acceleration.cron_schedule = <cron-string>
* Cron schedule to be used to probe/generate the column stores for this data model

Should I set up a cron to run every minute? Every 5 minutes? What is the suggested schedule?

Re: What is the data model acceleration default cron schedule?

somesoni2 — Mon, 27 Jul 2015 20:38:21 GMT

As per documentation, it's getting updated every 5 min. See the 2nd para from below link.

http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Acceleratedatamodels#After_you_enable_acceleration_for_a_data_model

Re: What is the data model acceleration default cron schedule?

MuS — Mon, 27 Jul 2015 20:43:49 GMT

Hi the_wolverine,

the default interval is 5 minutes, where Splunk runs a search to update existing data model summaries. It runs a maintenance process every 30 minutes to remove old, outdated summaries. See the docs http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Acceleratedatamodels#After_you_enable_acceleration_for_a_data_model

Before decreasing the interval; I would check if the data model acceleration summary search runs without error and on time, see the docs on this http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Acceleratedatamodels#How_Splunk_Enterprise_builds_data_model_acceleration_summaries

Hope this helps ...

cheers, MuS