Splunk Cloud Platform

Accerlated DataModel Questions

vn_g
Path Finder

A data model is created with root search dataset and is set to acceleration as well.

rootsearchquery1 : index=abc sourcetype=xyz field_1="1"
rootsearchquery2 : index=abc sourcetype=xyz field_1="1" | fields _time field_2 field_3
For both the queries, auto extracted fields are added. ( _time, field_2, field_3).

These are general questions for better understanding,  I would like to get suggestions in which scenario which usage (tstas, datamodel, root event , root search with streaming command, root search without streaming command) is preferrable?

1. |datamodel datamodelname datasetname | stats count by field_3
For Query 1, the output is pretty fast just below 10 seconds. (root search with out streaming command)
For Query 2, the output is more than 100 seconds. (root search with streaming command)

2. For Query 2, tstats command is also taking more than 100 seconds and only giving results when added summariesonly=false, why is it not giving results when summariesonly=true is added?
For Query 1, it works both summariesonly=false and true , and the output is pretty fast less than 2 seconds actually.

So, in what scenario is it mentioned that streaming commands in root search can be added and accerlated, when in return it is querying by adding fields twice which is becoming more inefficient?
eg : This is for Query 2

| datamodel datamodelname datasetname
| stats count by properties.ActionType

underlying query that is running :
(index=* OR index=_*) index=abc sourcetype="xyz" field_1="1" _time=* DIRECTIVES(READ_SUMMARY(datamodel="datamodelname.datasetname" summariesonly="false" allow_old_summaries="false"))
| fields "_time" field_2 field_3
| search _time = *
| fields "_time" field_2 field_3
| stats count by properties.ActionType

3. And in general what is recommended
- when a datamodel is accerlated, using either of them | datamodel or | tstats gives better performance.
- when a datamodel is not accerlated, using | tstats only gives better performance. 
Is this correct?

4. And when a datamodel is not accerlated, the command | datamodel pulls the data from _raw buckets, then what is the use of querying the data using datamodel instead of direct index? When the performance is same?

5. And while querying | datamodel datamodelname datasetname why is splunk by default adding ( index=* and index=_*)? It can be changed?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...