topic Re: How does data model acceleration work to help generate a report faster? in Splunk Search

How does data model acceleration work to help generate a report faster?

splunker12er — Sat, 11 Jul 2015 09:59:49 GMT

How does data model acceleration help in generating a report faster?

Creating a new data model from a 'root event' - and several child objects created using constraints - make a complete data set.

When I accelerate a data model (Eg : choosing a time-range of 7 days), it creates a directory under the same index with new folder 'datamodel_summary'

What are the fields getting accelerated? OR what kind events are stored in the data model summary?
How does the 'optional' & 'required' attributes impact acceleration? Are only the required fields accelerated?

How does the 'accelerated index' of a data model differ from an actual index?
What would the metadata structure be?

Re: How does data model acceleration work to help generate a report faster?

splunker12er — Sun, 12 Jul 2015 06:52:03 GMT

How can i efficiently accelerate my dataset to get reports faster ? Please advise

Re: How does data model acceleration work to help generate a report faster?

Smith_Splunk — Sun, 12 Jul 2015 09:14:53 GMT

Hi,
Most of your questions were well documented in Splunk doc.

http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Aboutdatamodels
http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Acceleratedatamodels
http://conf.splunk.com/speakers/2014.html#search=data%20model&

Re: How does data model acceleration work to help generate a report faster?

splunker12er — Sun, 12 Jul 2015 12:41:35 GMT

should i need to run some saved searches - and the results of my searches are alone accelerated by data model acceleration ?

http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Acceleratedatamodels

when you enable acceleration for a data model, Splunk Enterprise builds the initial set of .tsidx file summaries for the data model and then runs scheduled searches in the background every 5 minutes to keep those summaries up to date. Each update ensures that the entire configured time range is covered without a significant gap in data. This method of summary building also ensures that late-arriving data will be summarized without complication.

I would like to understand , when I accelerate a data-model , what type of data is stored in the datamode_summary ?
Is it mandatory , that i need to run some saved searches , and those result-set is alone accelerated ?

Re: How does data model acceleration work to help generate a report faster?

esix_splunk — Mon, 13 Jul 2015 00:17:19 GMT

You can think of datamodels as summary indexes. And accelerated datamodels provide another layer of effectively summarizing the data models with tsidx files to provide quicker responses to data results.

Inherently, datamodels are now recommended as they auto-backfill and drive the pivot tables and alot of the more advanced dashboards in Premium apps like ES and VMware.