Discrepancy between datamodel, summaries, & raw search

[richkappler]

We are running SE 6.5.4, ES 4.7.1, Splunk_SA_CIM - 4.8.0

I'm getting a discrepancy between 3 searches over the exact same 15 minute period (any given 15 minute period) for the following 3 searches:

| tstats count FROM datamodel=Web WHERE Web.action=blocked BY Web.category (test case: 49 results)

| tstats summariesonly count FROM datamodel=Web WHERE Web.action=blocked BY Web.category (test case: 44 results)

index=XXXX_proxy action=blocked | stats count by category (test case: 49 results)

Web datamodel is accelerated, Earliest time as set in CIM setup = 2 month

The disparity is not consistent. Sometimes the result count is equal for all 3 searches, sometimes the 2 data model searches are equal and raw is different, etc.

This is making us question the validity of our data models, it seems all three result sets should be the same.

How should I troubleshoot this?

[DalJeanis]

You didn't say what your latest= might be.

Run for a period that is both recent and safely in the past, where acceleration is sure to be complete, and where the time bounds match those on your acceleration rather than breaking across them. The three should match completely.

If they do not, then narrow the time frame until you identify a short part of the time frame where there is a difference, probably in your third search.

Then, look at the individual events and find which one is different. If this condition is true, then chances are, there is an event that matches the criteria of your third search but does not match the criteria of the CIM.

Correct either the CIM or the non-CIM search.

[richgalloway]

Depending on when the tstats command runs, the summariesonly option will make a difference in the results. If a datamodel acceleration is in progress, summariesonly=true tells tstats to ignore the incomplete DMA.

Otherwise, I cannot explain this phenomenon even though I've seen it myself.