Does Enterprise Security automatically re-enable data model acceleration?

[Lowell]

I'm trying to disable acceleration on a data model that's consuming a massive amount of memory on the indexers. All the correlation searches for this data model are disabled, and I'm fine with some of the related dashboards being slow or unavailable (if they use tstats, for example).

I disabled acceleration and it was re-enabled a few hours later. So far no one has confessed to re-enabling it.

So I'm wondering if there's some automatic "protect-you-from-yourself" functionality that turns acceleration back on automatically.

[Lowell · Accepted solution]

Yes, ES will automatically override DM acceleration state. This can be controlled under the "Data Inputs" manager UI. There's an entry called "Data Model Acceleration Enforcement" where this can be controlled on a more permanent basis.

This is controlled via modular input called dm_accel_settings that will enforce these settings.

[koshyk]

do you know how to change it in a Clustered ES system? (coz via its not changeable)