https://community.splunk.com/t5/Splunk-Search/Accelerating-data-model-with-dynamic-lookup-fields/m-p/172593#M49479 <P>Hi,<BR /> I'm using 6.1.x and have built a data model with a dynamic lookup attribute inside. I wonder if I enable the acceleration on this data model, how the dynamic lookup attribute pick up the value change? For example, there is a status attribute with could change from day to day. If the new value is not picked up by the accelerated index, can I schedule the index rebuild by someway so that it refreshes every day?</P> Tue, 20 May 2014 19:17:36 GMT lianjunj 2014-05-20T19:17:36Z https://community.splunk.com/t5/Splunk-Search/Accelerating-data-model-with-dynamic-lookup-fields/m-p/172593#M49479 <P>Hi,<BR /> I'm using 6.1.x and have built a data model with a dynamic lookup attribute inside. I wonder if I enable the acceleration on this data model, how the dynamic lookup attribute pick up the value change? For example, there is a status attribute with could change from day to day. If the new value is not picked up by the accelerated index, can I schedule the index rebuild by someway so that it refreshes every day?</P> Tue, 20 May 2014 19:17:36 GMT https://community.splunk.com/t5/Splunk-Search/Accelerating-data-model-with-dynamic-lookup-fields/m-p/172593#M49479 lianjunj 2014-05-20T19:17:36Z https://community.splunk.com/t5/Splunk-Search/Accelerating-data-model-with-dynamic-lookup-fields/m-p/172594#M49480 <P>I could remove the summary file daily based on the cron schedule to force the index rebuild. Will that work?</P> Wed, 21 May 2014 01:24:41 GMT https://community.splunk.com/t5/Splunk-Search/Accelerating-data-model-with-dynamic-lookup-fields/m-p/172594#M49480 lianjunj 2014-05-21T01:24:41Z https://community.splunk.com/t5/Splunk-Search/Accelerating-data-model-with-dynamic-lookup-fields/m-p/172595#M49481 <P>From the doc:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Acceleratedatamodels">http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Acceleratedatamodels</A></P> <P>"By default Splunk Enterprise automatically rebuilds persistently accelerated data models whenever it finds that those models are outdated. Data models can become outdated when the search stored in the data model configuration in savesearches.conf no longer matches the search for the actual data model. This can happen if the JSON file for an accelerated model is edited on disk without first disabling the model's acceleration.”</P> <P>That’s almost what I’m looking for. I wonder how can I programmatically make the data model outdated?</P> Thu, 22 May 2014 06:23:16 GMT https://community.splunk.com/t5/Splunk-Search/Accelerating-data-model-with-dynamic-lookup-fields/m-p/172595#M49481 lianjunj 2014-05-22T06:23:16Z https://community.splunk.com/t5/Splunk-Search/Accelerating-data-model-with-dynamic-lookup-fields/m-p/172596#M49482 <P>Hi </P> <P>Have you found a solution to this problem ?</P> <P>Regards,</P> Mon, 15 Sep 2014 14:12:45 GMT https://community.splunk.com/t5/Splunk-Search/Accelerating-data-model-with-dynamic-lookup-fields/m-p/172596#M49482 jlhamlet 2014-09-15T14:12:45Z