Splunk Cloud Platform

Accerlated DataModel Questions

vn_g
Path Finder

A data model is created with root search dataset and is set to acceleration as well.

rootsearchquery1 : index=abc sourcetype=xyz field_1="1"
rootsearchquery2 : index=abc sourcetype=xyz field_1="1" | fields _time field_2 field_3
For both the queries, auto extracted fields are added. ( _time, field_2, field_3).

These are general questions for better understanding,  I would like to get suggestions in which scenario which usage (tstas, datamodel, root event , root search with streaming command, root search without streaming command) is preferrable?

1. |datamodel datamodelname datasetname | stats count by field_3
For Query 1, the output is pretty fast just below 10 seconds. (root search with out streaming command)
For Query 2, the output is more than 100 seconds. (root search with streaming command)

2. For Query 2, tstats command is also taking more than 100 seconds and only giving results when added summariesonly=false, why is it not giving results when summariesonly=true is added?
For Query 1, it works both summariesonly=false and true , and the output is pretty fast less than 2 seconds actually.

So, in what scenario is it mentioned that streaming commands in root search can be added and accerlated, when in return it is querying by adding fields twice which is becoming more inefficient?
eg : This is for Query 2

| datamodel datamodelname datasetname
| stats count by properties.ActionType

underlying query that is running :
(index=* OR index=_*) index=abc sourcetype="xyz" field_1="1" _time=* DIRECTIVES(READ_SUMMARY(datamodel="datamodelname.datasetname" summariesonly="false" allow_old_summaries="false"))
| fields "_time" field_2 field_3
| search _time = *
| fields "_time" field_2 field_3
| stats count by properties.ActionType

3. And in general what is recommended
- when a datamodel is accerlated, using either of them | datamodel or | tstats gives better performance.
- when a datamodel is not accerlated, using | tstats only gives better performance. 
Is this correct?

4. And when a datamodel is not accerlated, the command | datamodel pulls the data from _raw buckets, then what is the use of querying the data using datamodel instead of direct index? When the performance is same?

5. And while querying | datamodel datamodelname datasetname why is splunk by default adding ( index=* and index=_*)? It can be changed?

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...