Splunk Enterprise Security

Splunk DataModel Acceleration High Run time Issue

zacksoft_wf
Contributor

Out of the dataModels provided with Enterprise Security, one of the accelerated datamodel suddenly has a very high run time than usual . Any suggestion for what could be the issue Or where in the internal logs we should see to identify potential root cause for it ?

Labels (1)
0 Karma
1 Solution

PickleRick
Ultra Champion

You mean searching from datamodel is slow or building summary is slow?

If the former - someone disabled acceleration?

If the latter - didn't the datamodel change recently? Changing definition of datasets requires rebuilding of summaries.

Or maybe you suddenly just have much more data?

View solution in original post

PickleRick
Ultra Champion

You mean searching from datamodel is slow or building summary is slow?

If the former - someone disabled acceleration?

If the latter - didn't the datamodel change recently? Changing definition of datasets requires rebuilding of summaries.

Or maybe you suddenly just have much more data?

zacksoft_wf
Contributor

@PickleRick 
It is the later (Building Summary is slow).
I am not sure if anyone has changed the definition lately.
However , if I perform a 'rebuild', will that have any adverse effect on the dataModel (like missing data , incorrect data..etc..?)  

0 Karma

PickleRick
Ultra Champion

Well, in theory, rebuilding should just rebuild the summary data from the index contents for a given range.

But it will be slow if you have lots of data.

Typically you define datasets early on when you don't have much data and the summaries are updated incrementaly using defined schedule (usually 5 minutes or so). If you decide to suddenly rebuild summaries for - let's say - 3 months back and it turns out that you have several terabytes of data to analyze... well, that can be painful for the indexers.

0 Karma

zacksoft_wf
Contributor

Is there a way, to know if there is a change in data Model definition ?
I'm trying to figure out the high run time issue, why the acceleration is taking time !

Btw - pickleRick is the coolest user name ever. 🙂

Tags (1)
0 Karma

PickleRick
Ultra Champion

I'm not really sure but short of having historic dumps of your configs and comparing with old revisions... I don't see any possibility. Maybe change of definitions triggers some entry in the logs but I'm not sure here.

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...