Splunk Enterprise Security

Data Model Acceleration Issue in ES Instance

aydinmo
Explorer

Hello Splunkers,

I'm encountering an issue with data model acceleration in my ES instance . A few weeks ago, I enabled several data models in my ES instance to support correlation searches. However, I recently noticed that there hasn't been any increase in SVC usage, and upon checking today, I found that the acceleration status for these models was disabled.

I'm puzzled by this and would appreciate any insights into why this occurred and how to identify the root cause.

Thank you.

0 Karma

meetmshah
Builder

Hello @aydinmo This could be because of Data Model Acceleration Enforcement.

What it does is, even if you turn DMA On/Off - it will enforce the default behaviour.

Can you please check the configurations from Settings -> Data Model Acceleration Enforcement Settings and Enable / Disable the default behaviour as required. Below screenshot for your reference - 

 

meetmshah_0-1711696041513.png

 

Here is the Splunk Doc for your reference - https://docs.splunk.com/Documentation/ES/7.3.0/Install/Datamodels#Data_model_acceleration_enforcemen...

 

Please accept the solution and hit Karma, if this helps!

aydinmo
Explorer

Thank you for the inputs. I checked and this is not the root cause. I need to identify the root cause to prevent such cases happening in the future.

0 Karma
Get Updates on the Splunk Community!

Get Schooled with Splunk Education: Explore Our Latest Courses

At Splunk Education, we’re dedicated to providing incredible learning experiences that cater to every skill ...

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...