- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- Re: How to tell if accelerated data model is still...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello. I have a data model that has been rebuilding for close to 24 hrs. This seems plausible since it is working on hundreds of millions of events, but I am wondering how I can tell if it is still working or if it has gotten hung or failed?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Found the solution. Open the data model and click "View Events". When I did this, I saw that a lookup was failing. This apparently was preventing the data model from being rebuilt. However, Settings -> Data Models -> left arrow still said the model was rebuilding, so that threw me off. I fixed the lookup and rebuilding worked. As an enhancement request/fix, it would be great if that screen told the user there was an error in rebuilding the data model instead of making it seem like it was still working on it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Most of the time it's a permissions issue with a lookup or knowledge object that the datamodel is using. You can debug by running the following search to narrow it down.
index=_internal sourcetype=scheduler <datamodel_name>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This helped me - my Data Model was stuck at building. Turns out because: The maximum number of concurrent auto-summarization searches on this instance has been reached
02-25-2020 09:23:00.892 +0000 INFO SavedSplunker - savedsearch_id="nobody;Splunk_SA_CIM;ACCELERATE_DM_Splunk_SA_CIM_Authentication_ACCELERATE", search_type="datamodel_acceleration", user="nobody", app="Splunk_SA_CIM", savedsearch_name="ACCELERATE_DM_Splunk_SA_CIM_Authentication_ACCELERATE", priority=highest, status=skipped, reason="The maximum number of concurrent auto-summarization searches on this instance has been reached", concurrency_category="summarization_scheduled", concurrency_context="saved-search_instance-wide", concurrency_limit=2, scheduled_time=1582622580, window_time=0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Found the solution. Open the data model and click "View Events". When I did this, I saw that a lookup was failing. This apparently was preventing the data model from being rebuilt. However, Settings -> Data Models -> left arrow still said the model was rebuilding, so that threw me off. I fixed the lookup and rebuilding worked. As an enhancement request/fix, it would be great if that screen told the user there was an error in rebuilding the data model instead of making it seem like it was still working on it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, I am facing the same issue and trying to follow the instructions from your article.But when i click on data model, i can view all list of various data model, but i don't find any option call "View Events". Could you please help me with this ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you go into Settings -> Data Models and click on the arrow on the left hand side, if the percentage goes up every once in a while, it should be still rebuildling. I had this same thing happen, took an entire week to "rebuild" the data model. Probably the last time i use the rebuild.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I do not see a percentage when I click on the arrow, but I do see the details below. Should the Size on Disk be increasing? It has been 0.00MB for the last 48 hrs.
ACCELERATION
Rebuild Update Edit
Status
Building
Access Count
0. Last Access: 1969-12-31T18:00:00-06:00
Size on Disk
0.00MB
Summary Range
0
Buckets
0
Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!
Transform your security operations with Splunk Enterprise Security
Splunk Admins and App Developers | Earn a $35 gift card!
