How can I force rebuild a datamodel acceleration? (Im using Splunk 6.2)
I already scheduled it, and I know that data has changed, because it depends on lookups that already changed.
My datamodel.conf
[my_datamodel]
acceleration.manual_rebuilds = 0
acceleration = 1
acceleration.cron_schedule = */15 * * * *
acceleration.earliest_time = 0
PS: My lookups are updated each day.
To manually rebuild, go to Settings->Data Models, expand your (accelerated) data model and click on "Rebuild".
Screenshot here
[my_datamodel]
acceleration.manual_rebuilds = 0
acceleration = 1
acceleration.cron_schedule = */15 * * * *
acceleration.earliest_time = 0