Data Model Acceleration Issue in ES Instance

[aydinmo]

Hello Splunkers,

I'm encountering an issue with data model acceleration in my ES instance . A few weeks ago, I enabled several data models in my ES instance to support correlation searches. However, I recently noticed that there hasn't been any increase in SVC usage, and upon checking today, I found that the acceleration status for these models was disabled.

I'm puzzled by this and would appreciate any insights into why this occurred and how to identify the root cause.

Thank you.

[meetmshah]

Hello @aydinmo This could be because of Data Model Acceleration Enforcement.

What it does is, even if you turn DMA On/Off - it will enforce the default behaviour.

Can you please check the configurations from Settings -> Data Model Acceleration Enforcement Settings and Enable / Disable the default behaviour as required. Below screenshot for your reference - 

Here is the Splunk Doc for your reference - https://docs.splunk.com/Documentation/ES/7.3.0/Install/Datamodels#Data_model_acceleration_enforcemen...

Please accept the solution and hit Karma, if this helps!

[aydinmo]

Thank you for the inputs. I checked and this is not the root cause. I need to identify the root cause to prevent such cases happening in the future.