Hello,
I'm working with Splunk 6.4.1. I have an accelerated data model with calculated fields, and aliases configured to map index fields to the data model calculated fields. I recently had to add a new calculated field to the data model, so I disabled the acceleration, added the field, and then created a new field alias. Everything works as expected. When I re-enable the data model acceleration, however, I've noticed, that the field aliases don't work anymore. For the time being I've disabled data model acceleration. How do I get the alias to work with data model acceleration enabled?
Regards,
Andrew
I have the same issue. I found this tip on a related question: https://answers.splunk.com/answers/700613/some-events-missing-from-data-model-only-if-accele.html, specifically:
Please edit/create the file $SPLUNK_HOME/etc/system/local/limits.conf .
Add the following stanza
[directives]
read_summary = disabled
Restart the instance for changes to take effect.
In a distributed env it should be done on the SH.
The setting is defined as follows on Splunk Docs (https://docs.splunk.com/Documentation/Splunk/latest/Admin/LimitsConf):
read_summary = enabled|disabled
* Enables the use of the read summary directive, which allows the search
processor to leverage existing data model acceleration summary data when it
performs event searches.
* Disable this setting only to troubleshoot issues with search results.
* Default: true