Reporting

Is there an option available to prioritize the creation of data model acceleration stack to make the rebuild faster in case changes are applied?

mmaier_splunk
Splunk Employee
Splunk Employee

Hello,

is there a option/capability available to prioritize the creation/rebuild of the data model acceleration stack to make the rebuild faster in case changes have applied to a accelerated data model?

thanks

Tags (2)

lmyrefelt
Builder

It should update / rebuild the model/ acceleration data "each time" you run a search if i don't remember wrong. Not so much you need to do update those after a change ... the same goes after you deleted them (from disk) ... then they will get recreated at search launch.

You should find the answer here;

http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Aboutdatamodels

In limits.conf we can specify some settings regarding the "priority" we want to give our acceleration / data model generation.

[scheduler]
max_searches_perc = <integer>
* The maximum number of searches the scheduler can run, as a percentage of the maximum number of concurrent
searches, see [search] max_searches_per_cpu for how to set the system wide maximum number of searches.
* Defaults to 50.

auto_summary_perc = <integer>
* The maximum number of concurrent searches to be allocated for auto summarization, as a percentage of the
concurrent searches that the scheduler can run.
* Auto summary searches include:
  * Searches which generate the data for the Report Acceleration feature.
  * Searches which generate the data for Data Model acceleration.
* Note: user scheduled searches take precedence over auto summary searches.
* Defaults to 50.

and you have also;

[auto_summarizer]

That you might want to check out.

Here is a link to its spec file;
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf

mmaier_splunk
Splunk Employee
Splunk Employee

Hello lmyrefelt,

thanks a lot for your response. the questions is if the "update/rebuild" process can be prioritized as in an environment with terabytes of data and scripted lookups that are part of the data model the rebuild can take some time.

br

0 Karma

lmyrefelt
Builder

There "is" ... Se my updated answer

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...