Splunk Search

How accelerate only one root dataset from datamodel with multiple datasets?

kyokkygo
Engager

Hi! I try to accelerate only one dataset in datamodel with multiple datasets. How i can do it through datamodel.conf or in web ui? 

In webui i cant choose acceleration in edit drilldown(

0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

You define acceleration (and its parameters) only at datamodel level. You can't accelerate specific dataset(s) or differentiate parameters between different dataset within a single datamodel.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You define acceleration (and its parameters) only at datamodel level. You can't accelerate specific dataset(s) or differentiate parameters between different dataset within a single datamodel.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kyokkygo,

you can do DataModel accelarations by GUI only at root level in [Settings > Data Model]

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...