Reporting

How to use accelerate datamodel in search?

kobon
Explorer

How to I must write search so that use acceleration?
How to write search so that not use acceleration?
Thanks

0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

To search from accelerated datamodels, try below query (That will give you count).

| tstats summariesonly=t count from datamodel=<data_model-name>

For example to search data from accelerated Authentication datamodel.

| tstats summariesonly=t count from datamodel=Authentication

To search data without acceleration, try below query.

| tstats count from datamodel=<data_model-name>

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

To search from accelerated datamodels, try below query (That will give you count).

| tstats summariesonly=t count from datamodel=<data_model-name>

For example to search data from accelerated Authentication datamodel.

| tstats summariesonly=t count from datamodel=Authentication

To search data without acceleration, try below query.

| tstats count from datamodel=<data_model-name>

harsmarvania57
SplunkTrust
SplunkTrust

You may use allow_old_summaries=t while searching from accelerated datamodels if your datamodel definition has been changed. Please refer doc : https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Tstats for more options.

0 Karma

kobon
Explorer

Thanks for help, maybe you know how to fix it problem "data model 'modelname' had an invalid search, cannot get indexes to search" ?. Thanks

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

What is your root search definition in datamodel ? If you try to run that root search in your search directly, is it working?

0 Karma

kobon
Explorer

This error is not related to your answer to the question regarding acceleration. An error occurred in my friend, and the only thing I know about the error is its name. Maybe you know what could be the reasons for this error?

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...