Splunk Enterprise

How can I enable inactive data models?

DanAlexander
Communicator

Morning all,

I am new to Data Models and wanted some guidance of how I can enable some of the inactive ones. Is acceleration available after the Data Model is activated. I am confused with acceleration and how to enable a Data Model. I just want to enable our Endpoint Data Model as we are gaining logs from Universal Forwarder and Sysmon as well. Wanted to find some useful Endpoint use cases I can start using.  

Any help much appreciated!

Thank you!

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not sure what you mean by "inactive" and "active" with regard to data models.  That's not a term I've seen used in that context.  Likewise with "enabled".  If a data model exists then it's enabled.

Data model acceleration (DMA) is another matter.  DMA can be enabled in the Settings->Data models page.  Chose "Edit Acceleration" from the Edit menu of the appropriate data model.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...