Splunk DataModel Acceleration High Run time Issue

[zacksoft_wf]

Out of the dataModels provided with Enterprise Security, one of the accelerated datamodel suddenly has a very high run time than usual . Any suggestion for what could be the issue Or where in the internal logs we should see to identify potential root cause for it ?

[PickleRick · Accepted solution]

You mean searching from datamodel is slow or building summary is slow?

If the former - someone disabled acceleration?

If the latter - didn't the datamodel change recently? Changing definition of datasets requires rebuilding of summaries.

Or maybe you suddenly just have much more data?

[zacksoft_wf]

@PickleRick 
It is the later (Building Summary is slow).
I am not sure if anyone has changed the definition lately.
However , if I perform a 'rebuild', will that have any adverse effect on the dataModel (like missing data , incorrect data..etc..?)  

[PickleRick]

Well, in theory, rebuilding should just rebuild the summary data from the index contents for a given range.

But it will be slow if you have lots of data.

Typically you define datasets early on when you don't have much data and the summaries are updated incrementaly using defined schedule (usually 5 minutes or so). If you decide to suddenly rebuild summaries for - let's say - 3 months back and it turns out that you have several terabytes of data to analyze... well, that can be painful for the indexers.

[zacksoft_wf]

Is there a way, to know if there is a change in data Model definition ?
I'm trying to figure out the high run time issue, why the acceleration is taking time !

Btw - pickleRick is the coolest user name ever. 🙂

[PickleRick]

I'm not really sure but short of having historic dumps of your configs and comparing with old revisions... I don't see any possibility. Maybe change of definitions triggers some entry in the logs but I'm not sure here.