Splunk Search

Accelerated data model returning partial results when using summariesonly=true

Path Finder

Hello everybody, I see a strange behaviour with data model acceleration.

I have a data model accelerated over 3 months. According to internal logs, scheduled acceleration searches are not skipped and they complete providing results.

However if I run a tstats search over last month with “summariesonly=true”, I do not get any values back; if I run the same tstats search with “summariesonly=false”, I do get expected results. Again, if I run the tstats search over the last 90 days with "summariesonly=true", I get some values back.

Have you ever faced a similar situation? Could this depend upon the small number of events, thus upon buckets not rolled yet?

Please not that this does not look like a generic "recent data not yet summarised" issue, because:

  • acceleration searches complete with success every 5 minutes;
  • data model summary is 100% built;
  • I am missing data at least from the last month.

Thank you for your support!

0 Karma

Path Finder

Hello, some updates.

I focused on a short time window for a specific dataset and I found out that accelerated searches ("tstats", "from datamodel" and "datamodel") return 4 events.

On the other hand, raw searches, built both from datamodel definition and using "| datamodel flat_string", return 11 events in the same time window.

The really strange thing is that the acceleration search, executed on the same time window, returns 11 events. I retrieved the acceleration search with "| datamodel acceleration_search_string" and I executed it with a filter on "nodename=".

It looks like, in some way, summary indexes do not store all the expected data. Acceleration searches run every 5 minutes. Sometimes they are skipped due to concurrency limits, but their execution is later recovered.

Any clues or ideas?

0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...