Reporting

Can we have datamodel acceleration for All Time?

ddrillic
Ultra Champion

When we set the datamodel acceleration, we see the All Time option. Can we truly have data back without limit? How can we measure the storage and processing impact of this setting?

alt text

0 Karma

jnudell_2
Builder

Yes, you can have it accelerated for all time. You would still be limited to the retention period of the index that contributes to the data model. I would be careful with setting it to all time though, because of the disk space usage as you've mentioned.

You could probably get a better answer if you provided a specific use case. Or were you just curious?

ddrillic
Ultra Champion

I guess you are right @jnudell_2 about my real question - what's the relation between the Summary Range of the datamodel and the retention of the index that contributes to the datamodel?

0 Karma

jnudell_2
Builder

As mentioned in the answer, the summary range will not go past the retention limit of the index, because data models are stored in the index folder, and are subject to the retention of the index they're modeling off of. Therefore, even if you set the data model to accelerate for "all time", it would only be for all available time for that particular index given the retention period.

ddrillic
Ultra Champion

Any thoughts on this one, by any chance?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...