Reporting

What is the data model acceleration default cron schedule?

the_wolverine
Champion

I have data model acceleration enabled and have seen that the data model is not keeping up with the raw data (my dashboards populated by tstats are not showing recent data and can be behind by 1 hour). The datamodels.conf stanzas do not contain a cron. So I'm wondering if there is a default schedule is being used -- and if so -- what is is that schedule?

According to data models.conf.spec:

acceleration.cron_schedule = <cron-string>
* Cron schedule to be used to probe/generate the column stores for this data model

Should I set up a cron to run every minute? Every 5 minutes? What is the suggested schedule?

MuS
SplunkTrust
SplunkTrust

Hi the_wolverine,

the default interval is 5 minutes, where Splunk runs a search to update existing data model summaries. It runs a maintenance process every 30 minutes to remove old, outdated summaries. See the docs http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Acceleratedatamodels#After_you_enable_ac...

Before decreasing the interval; I would check if the data model acceleration summary search runs without error and on time, see the docs on this http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Acceleratedatamodels#How_Splunk_Enterpri...

Hope this helps ...

cheers, MuS

somesoni2
Revered Legend

As per documentation, it's getting updated every 5 min. See the 2nd para from below link.

http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Acceleratedatamodels#After_you_enable_ac...

Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...