Reporting

How to tell if accelerated data model is still rebuilding?

jamesvz84
Communicator

Hello. I have a data model that has been rebuilding for close to 24 hrs. This seems plausible since it is working on hundreds of millions of events, but I am wondering how I can tell if it is still working or if it has gotten hung or failed?

Labels (1)
Tags (2)
1 Solution

jamesvz84
Communicator

Found the solution. Open the data model and click "View Events". When I did this, I saw that a lookup was failing. This apparently was preventing the data model from being rebuilt. However, Settings -> Data Models -> left arrow still said the model was rebuilding, so that threw me off. I fixed the lookup and rebuilding worked. As an enhancement request/fix, it would be great if that screen told the user there was an error in rebuilding the data model instead of making it seem like it was still working on it.

View solution in original post

shaskell_splunk
Splunk Employee
Splunk Employee

Most of the time it's a permissions issue with a lookup or knowledge object that the datamodel is using. You can debug by running the following search to narrow it down.

index=_internal sourcetype=scheduler <datamodel_name>

swatts1000
Explorer

This helped me - my Data Model was stuck at building. Turns out because: The maximum number of concurrent auto-summarization searches on this instance has been reached

02-25-2020 09:23:00.892 +0000 INFO SavedSplunker - savedsearch_id="nobody;Splunk_SA_CIM;ACCELERATE_DM_Splunk_SA_CIM_Authentication_ACCELERATE", search_type="datamodel_acceleration", user="nobody", app="Splunk_SA_CIM", savedsearch_name="ACCELERATE_DM_Splunk_SA_CIM_Authentication_ACCELERATE", priority=highest, status=skipped, reason="The maximum number of concurrent auto-summarization searches on this instance has been reached", concurrency_category="summarization_scheduled", concurrency_context="saved-search_instance-wide", concurrency_limit=2, scheduled_time=1582622580, window_time=0

0 Karma

jamesvz84
Communicator

Found the solution. Open the data model and click "View Events". When I did this, I saw that a lookup was failing. This apparently was preventing the data model from being rebuilt. However, Settings -> Data Models -> left arrow still said the model was rebuilding, so that threw me off. I fixed the lookup and rebuilding worked. As an enhancement request/fix, it would be great if that screen told the user there was an error in rebuilding the data model instead of making it seem like it was still working on it.

View solution in original post

raomu
Explorer

Hi, I am facing the same issue and trying to follow the instructions from your article.But when i click on data model, i can view all list of various data model, but i don't find any option call "View Events". Could you please help me with this ?

0 Karma

aelliott
Motivator

If you go into Settings -> Data Models and click on the arrow on the left hand side, if the percentage goes up every once in a while, it should be still rebuildling. I had this same thing happen, took an entire week to "rebuild" the data model. Probably the last time i use the rebuild.

0 Karma

jamesvz84
Communicator

I do not see a percentage when I click on the arrow, but I do see the details below. Should the Size on Disk be increasing? It has been 0.00MB for the last 48 hrs.

ACCELERATION
Rebuild Update Edit
Status
Building
Access Count
0. Last Access: 1969-12-31T18:00:00-06:00
Size on Disk
0.00MB
Summary Range
0
Buckets
0

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.