Splunk Common Information Model (CIM): Why is data model acceleration not working for Email data model?

[cwilmoth]

We are running the latest versions of Splunk Enterprise, Splunk Enterprise Security, and Splunk Common Information Model (CIM) [SA_CIM]. I can enable acceleration for the Email data model, but it never goes past 0% built and always says "Building". I am not having issues with any other data model. If I search for tag=email like the data model constrains to, I get plenty of events (Cisco IronPort source). If I search the data model | datamodel Email search, it returns events. Yet acceleration (which drives the email dashboards) does not work. If I clone the Email model to Email_temp and accelerate the new one, it works fine. What could be the issue here?

Thanks

Craig

[rpille_splunk]

Go to the CIM setup page and tune the max time and backfill time. See http://docs.splunk.com/Documentation/CIM/4.7.0/User/Setup#Accelerate_CIM_data_models

Further details here:

http://docs.splunk.com/Documentation/Splunk/6.5.3/Knowledge/Acceleratedatamodels#When_summary-popula...

[rpille_splunk]

Make sure you are making your acceleration setting changes in the Data Model Acceleration Enforcement modular input on your search head. ES overrides any acceleration changes you try to make elsewhere. The Email data model is accelerated by ES by default, so you probably should not need to make changes here unless someone went to this modular input and deaccelerated the model.

Next, you can adjust the settings on the CIM setup for the Email data model to see if tweaking the settings there helps the data model finish building.

[cwilmoth]

The data model is accelerated. I can go to the Data Model Audit page and see that it is enabled, but it does not build. It is always at 0. When I clone it to a new name, that model builds to completion in about 10 minutes. I can leave the Email model go for days and it never goes past 0.

The scheduler is running the searches for this every five minutes but it looks like it is coming back with zero results every time. I started digging through the acceleration searches and I think I found something. There is a warning from the StringSearchExpander that it is "Unable to find tag email". This tag is specified in the TA_cisco_esa app and has global permissions, so I'm not sure why it can't be "found".

[wcwnesta]

Hi cwilmoth:
I met similar problems like you, the data model WEB can not be accelerated. But it works opposite to yours. the WEB completes the accerleration immediately and it shows 'done'. But indeed it did not accelerate anything.

I copy the WEB to WEB2, and it works fine.

Did you solve this problems?