Why is my Data Model not consistently returning data?

[user4455]

I have a data model with FW and Apache logs in it. It's set for 7 days and Accelerated. The problem is with the web logs. I can use the pivot tool and try and view the last 7 days based on the http_status_code and it will return 0 results. A few minutes later, I do it again and all the data is there. Later on, it will be gone again. The Data Model says it is 100%. There is data consistently every day too.

It feels like the data is not being loaded or kept in the model.

Anyone have any tips?

Thanks

[hunters_splunk]

Hi user4455,

Seems that your search is returning data very slowly, which shouldn't be the case with accelerated data models. You can run the following search to see how many events your search is scanning.

| tstats count from datamodel=<your_data_model>
by http_status_code
| sort -count

Also, try this command that generates results from the TSIDX data automatically generated by the acceleration, unsummarized data is not included:

| tstats count from datamodel=AccButtercup_Games_Online_Sales
summariesonly=t

Hope this helps. Thanks!
Hunter