What is the data model acceleration default cron schedule?

[the_wolverine]

I have data model acceleration enabled and have seen that the data model is not keeping up with the raw data (my dashboards populated by tstats are not showing recent data and can be behind by 1 hour). The datamodels.conf stanzas do not contain a cron. So I'm wondering if there is a default schedule is being used -- and if so -- what is is that schedule?

According to data models.conf.spec:

acceleration.cron_schedule = <cron-string>
* Cron schedule to be used to probe/generate the column stores for this data model

Should I set up a cron to run every minute? Every 5 minutes? What is the suggested schedule?

[MuS]

Hi the_wolverine,

the default interval is 5 minutes, where Splunk runs a search to update existing data model summaries. It runs a maintenance process every 30 minutes to remove old, outdated summaries. See the docs http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Acceleratedatamodels#After_you_enable_ac...

Before decreasing the interval; I would check if the data model acceleration summary search runs without error and on time, see the docs on this http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Acceleratedatamodels#How_Splunk_Enterpri...

Hope this helps ...

cheers, MuS

[somesoni2]

As per documentation, it's getting updated every 5 min. See the 2nd para from below link.

http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Acceleratedatamodels#After_you_enable_ac...