Does anyone have experience with how indexing latency affects accelerated data models and how to handle this?

[romedome]

Has anyone had any experience on how indexing lag affects accelerated data models and ways to mitigate the issue?

Thanks!

[woodcock · Accepted solution]

It is all handled automatically in a lossless way (unlike Summary Indices). So your only concern, is to not search for (rely on) data that has happened more recently than the max duration of your input + indexer pipeline latency.

[romedome]

That's reassuring. Is there any documentation that shows how this "losslessness" works?

Thanks!

[woodcock]

It is because all of the magic happens WHENEVER the event is indexed as PART OF the indexing process. Therefore, it is impossible for the acceleration to be missed, even if event/pipeline latency is very large.

https://helgeklein.com/blog/2015/10/splunk-accelerated-data-models-part-1/
http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/Acceleratedatamodels

[romedome]

Cool blog post! Thanks!