in general terms I have a data model that is accelerated and that has a field that comes from a lookup. This lookup is constantly changing.
Now the question is does the field get only the values from the lookup in it's version when I started the acceleration (or restartet Splunk) or do the updates of the lookup reflect in the accelerated data model? If they do reflect then which delay could I expect?
The answer is depends on this setting in datamodels.conf:
acceleration.manual_rebuilds = <bool>
* ADVANCED: When set to 'true,' this setting prevents outdated summaries from
being rebuilt by the 'summarize' command.
* Normally, during the creation phase, the 'summarize' command automatically
rebuilds summaries that are considered to be out-of-date, such as when the
configuration backing the data model changes.
* The Splunk software considers a summary to be outdated when:
* The data model search stored in its metadata no longer matches its current
data model search.
* The search stored in its metadata cannot be parsed.
* NOTE: If the Splunk software finds a partial summary be outdated, it always
rebuilds that summary so that a bucket summary only has results corresponding to
one datamodel search.
* Defaults to: false
The lookup file is a configuration backing the data model, so lookup changes would result in rebuilding the acceleration for datamodels where this is set to the default false.
It's worth noting that the CIM datamodels set this to true, so the CIM datamodels don't constantly rebuild. But if your datamodel is one you custom built, you would need to ensure this is set to true to avoid having the acceleration continuously rebuilt every time your lookup is updated.