Splunk Cloud Platform

Accerlated DataModel Questions

vn_g
Path Finder

A data model is created with root search dataset and is set to acceleration as well.

rootsearchquery1 : index=abc sourcetype=xyz field_1="1"
rootsearchquery2 : index=abc sourcetype=xyz field_1="1" | fields _time field_2 field_3
For both the queries, auto extracted fields are added. ( _time, field_2, field_3).

These are general questions for better understanding,  I would like to get suggestions in which scenario which usage (tstas, datamodel, root event , root search with streaming command, root search without streaming command) is preferrable?

1. |datamodel datamodelname datasetname | stats count by field_3
For Query 1, the output is pretty fast just below 10 seconds. (root search with out streaming command)
For Query 2, the output is more than 100 seconds. (root search with streaming command)

2. For Query 2, tstats command is also taking more than 100 seconds and only giving results when added summariesonly=false, why is it not giving results when summariesonly=true is added?
For Query 1, it works both summariesonly=false and true , and the output is pretty fast less than 2 seconds actually.

So, in what scenario is it mentioned that streaming commands in root search can be added and accerlated, when in return it is querying by adding fields twice which is becoming more inefficient?
eg : This is for Query 2

| datamodel datamodelname datasetname
| stats count by properties.ActionType

underlying query that is running :
(index=* OR index=_*) index=abc sourcetype="xyz" field_1="1" _time=* DIRECTIVES(READ_SUMMARY(datamodel="datamodelname.datasetname" summariesonly="false" allow_old_summaries="false"))
| fields "_time" field_2 field_3
| search _time = *
| fields "_time" field_2 field_3
| stats count by properties.ActionType

3. And in general what is recommended
- when a datamodel is accerlated, using either of them | datamodel or | tstats gives better performance.
- when a datamodel is not accerlated, using | tstats only gives better performance. 
Is this correct?

4. And when a datamodel is not accerlated, the command | datamodel pulls the data from _raw buckets, then what is the use of querying the data using datamodel instead of direct index? When the performance is same?

5. And while querying | datamodel datamodelname datasetname why is splunk by default adding ( index=* and index=_*)? It can be changed?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2026-2027 SplunkTrust is officially open. If ...