Data model acceleration not sticking

[MKozanic]

Hi All,

I'm not that familiar with DMA as I have not had any exposure really to setting up data models so far but am currently having an issue atm with DMA not saying active.

We had to disabled DMA on all ES data models where it was enabled due to an incident recently.  Now that the issues have been resolved, we need to re-enable DMA.

I have attempted to do this by following the below steps: 
1. Go to the ES app
2. Click "Configure" -> "CIM Setup"
3. Check the checkbox next to the "Accelerate" then change the Summary Range to 7 days (- 7 days), then click Save.
4. To verify , click "Configure" -> "Content" -> "Content Management".
5. Filter the type to "Data Model"
6. Check the lightning icon next in the row of the data model if is coloured "yellow".

This looked like it was working for a while, but after checking on it after a few hrs - all DMA had been disabled again.

Not sure why DMA will not stay enabled - have checked settings, nothing obvious as to why this would be happening.

Anyone else out there had this issue or got some idea on something I can check as to why this would be happening?

[MKozanic]

I have tried to enforce acceleration on one model but am getting an error message: 

I just read this is a known bug with ES 6.0 (we are on 6.0.2) so assuming I will need to look at a work around to get this working.

[MKozanic]

Hi @richgalloway ,

Looking at the setting again, I noticed that enforcement is set to false - just wondering if this needs to be updated to True?

Would this be the cause of it turning off once after it has been running for a while?

[richgalloway]

Check the DMA Enforcement settings at Settings->Data Inputs->Datamodel Acceleration Enforcement.  Turn off enforcement for each DMA you wish to disable.  Then go back to the CIM Setup page to turn off the DMA.

[MKozanic · Accepted solution]

Thanks @richgalloway , 

While your advise was reverse to what I needed to do, it was correct.

In my case I needed to set acceleration enforcement = True for the models I was trying to enable.

However, due to a known issue version 6.0 (which we are on), I was not able to do this via the GUI and needed to run curl command to update via rest.

curl -ku admin https://<ServerAddress>:8089/servicesNS/nobody/SplunkEnterpriseSecuritySuite/data/inputs/dm_accel_settings/<dataModelName> --data "acceleration=true&manual_rebuilds=true&output_mode=json"

[MKozanic]

Hi @richgalloway, 

Thanks for the response, only we want to enable DMA - not disable.

I did check under DMA Enforcement settings at Settings->Data Inputs->Datamodel Acceleration Enforcement, but all looked OK as best I could see.

Will get some screen shots today and add to post