https://community.splunk.com/t5/Splunk-Search/Why-are-some-events-not-summarized-in-a-data-model/m-p/366369#M108058 <P>Run the Health Checks on your MC and look for skipped searches. If you have overloaded your Indexers or Search Head, you may be skipping data model acceleration searches. If so, you will have to add cores available to search ( <CODE>limits.conf</CODE> and <CODE>datamodels.conf</CODE> ) and maybe more Indexers, too. Also run your search for <CODE>yesterday</CODE>; do the 2 searches match for that?</P> Fri, 17 Mar 2017 18:12:01 GMT woodcock 2017-03-17T18:12:01Z https://community.splunk.com/t5/Splunk-Search/Why-are-some-events-not-summarized-in-a-data-model/m-p/366367#M108056 <P>I have an accelerated datamodel configured, and if I run a tstats against it, I'm getting the results as expected.<BR /> However, if I add summariesonly=t to my tstats, some I get less results. I've tried rebuilding the datamodel, at 100% the same issue happens. Can be something misconfigured, resulting in some of the events not getting summarized ?</P> Fri, 17 Mar 2017 16:13:12 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-some-events-not-summarized-in-a-data-model/m-p/366367#M108056 szabados 2017-03-17T16:13:12Z https://community.splunk.com/t5/Splunk-Search/Why-are-some-events-not-summarized-in-a-data-model/m-p/366368#M108057 <P>If you run this search for say a 1 hour window from yesterday with and without summariesonly=t do the numbers match?</P> <P>If you run it with summariesonly=f for current data, it is very possible that an event that you just indexed has not yet been summarized.</P> <P>Depending on how often and how long your acceleration is running there could be a big lag.</P> Fri, 17 Mar 2017 16:48:53 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-some-events-not-summarized-in-a-data-model/m-p/366368#M108057 jwelch_splunk 2017-03-17T16:48:53Z https://community.splunk.com/t5/Splunk-Search/Why-are-some-events-not-summarized-in-a-data-model/m-p/366369#M108058 <P>Run the Health Checks on your MC and look for skipped searches. If you have overloaded your Indexers or Search Head, you may be skipping data model acceleration searches. If so, you will have to add cores available to search ( <CODE>limits.conf</CODE> and <CODE>datamodels.conf</CODE> ) and maybe more Indexers, too. Also run your search for <CODE>yesterday</CODE>; do the 2 searches match for that?</P> Fri, 17 Mar 2017 18:12:01 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-some-events-not-summarized-in-a-data-model/m-p/366369#M108058 woodcock 2017-03-17T18:12:01Z