Trying to accelerate data model, never stops building

[mjones414]

I've been trying to build a 7 day data model and have yet to successfully get the acceleration progress to move beyond building. The buckets and size are always 0 and its been over 15 hours. How can I troubleshoot the acceleration and identify what the problem is?

[aneels_splunk · Accepted solution]

There are a number of things that might be going on here. Does your data model contain event-based objects? Splunk only accelerated the first event-based object in a model, and its descendants. Search-based and Transaction-based objects can't be accelerated. (See the docs for more info.)

If you haven't already, you can also try disabling acceleration, making a trivial edit on your data model (e.g. add a field via eval) and then re-enabling. This ought to reset the acceleration.

[mjones414]

So then, if I were to accelerate different types of data that come from the same indexes, this becomes problematic because I have to add all the Auto-Extracted events to the root event and manually hide each one on the child events because auto-extracted is greyed out on child events.

Wouldnt that ultimately make a data storage nightmare for me if I were to break these indexes out multiple times in their own data models just because I want them accelerated?