Hello everybody, I see a strange behaviour with data model acceleration.
I have a data model accelerated over 3 months. According to internal logs, scheduled acceleration searches are not skipped and they complete providing results.
However if I run a tstats search over last month with “summariesonly=true”, I do not get any values back; if I run the same tstats search with “summariesonly=false”, I do get expected results. Again, if I run the tstats search over the last 90 days with "summariesonly=true", I get some values back.
Have you ever faced a similar situation? Could this depend upon the small number of events, thus upon buckets not rolled yet?
Please not that this does not look like a generic "recent data not yet summarised" issue, because:
acceleration searches complete with success every 5 minutes;
I focused on a short time window for a specific dataset and I found out that accelerated searches ("tstats", "from datamodel" and "datamodel") return 4 events.
On the other hand, raw searches, built both from datamodel definition and using "| datamodel flat_string", return 11 events in the same time window.
The really strange thing is that the acceleration search, executed on the same time window, returns 11 events. I retrieved the acceleration search with "| datamodel accelerationsearchstring" and I executed it with a filter on "nodename=".
It looks like, in some way, summary indexes do not store all the expected data. Acceleration searches run every 5 minutes. Sometimes they are skipped due to concurrency limits, but their execution is later recovered.