Knowledge Management

Delayed/Offset Datamodel Acceleration

Path Finder

I have a large set of data that comes in to splunk regularly but on couple days delay. It needs to be accelerated to be usable in our environment but I think If I wanted a 7 day datamodel I would need some way to tell the datamodel to start accelerating at -3d and go back 7 days from there to give the data some time to get in instead of starting now and going back 7 days as data will never be in "now".

Any thoughts / suggestions other than just making a summary index manually?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...