Splunk Search

Accelerated data model returning partial results when using summariesonly=true

mas
Path Finder

Hello everybody, I see a strange behaviour with data model acceleration.

I have a data model accelerated over 3 months. According to internal logs, scheduled acceleration searches are not skipped and they complete providing results.

However if I run a tstats search over last month with “summariesonly=true”, I do not get any values back; if I run the same tstats search with “summariesonly=false”, I do get expected results. Again, if I run the tstats search over the last 90 days with "summariesonly=true", I get some values back.

Have you ever faced a similar situation? Could this depend upon the small number of events, thus upon buckets not rolled yet?

Please not that this does not look like a generic "recent data not yet summarised" issue, because:

  • acceleration searches complete with success every 5 minutes;
  • data model summary is 100% built;
  • I am missing data at least from the last month.

Thank you for your support!

0 Karma

mas
Path Finder

Hello, some updates.

I focused on a short time window for a specific dataset and I found out that accelerated searches ("tstats", "from datamodel" and "datamodel") return 4 events.

On the other hand, raw searches, built both from datamodel definition and using "| datamodel flat_string", return 11 events in the same time window.

The really strange thing is that the acceleration search, executed on the same time window, returns 11 events. I retrieved the acceleration search with "| datamodel acceleration_search_string" and I executed it with a filter on "nodename=".

It looks like, in some way, summary indexes do not store all the expected data. Acceleration searches run every 5 minutes. Sometimes they are skipped due to concurrency limits, but their execution is later recovered.

Any clues or ideas?

0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...