How does Splunk handle lookups when accelerating a data model?

[gschr]

Hi,

in general terms I have a data model that is accelerated and that has a field that comes from a lookup. This lookup is constantly changing.

Now the question is does the field get only the values from the lookup in it's version when I started the acceleration (or restartet Splunk) or do the updates of the lookup reflect in the accelerated data model? If they do reflect then which delay could I expect?

Thank you in advance
Georg

[micahkemp]

The answer is depends on this setting in datamodels.conf:

acceleration.manual_rebuilds = <bool>
* ADVANCED: When set to 'true,' this setting prevents outdated summaries from 
  being rebuilt by the 'summarize' command.
* Normally, during the creation phase, the 'summarize' command automatically 
  rebuilds summaries that are considered to be out-of-date, such as when the 
  configuration backing the data model changes.
* The Splunk software considers a summary to be outdated when:
    * The data model search stored in its metadata no longer matches its current 
      data model search.
    * The search stored in its metadata cannot be parsed.
* NOTE: If the Splunk software finds a partial summary be outdated, it always 
  rebuilds that summary so that a bucket summary only has results corresponding to
  one datamodel search.
* Defaults to: false

The lookup file is a configuration backing the data model, so lookup changes would result in rebuilding the acceleration for datamodels where this is set to the default false.

It's worth noting that the CIM datamodels set this to true, so the CIM datamodels don't constantly rebuild. But if your datamodel is one you custom built, you would need to ensure this is set to true to avoid having the acceleration continuously rebuilt every time your lookup is updated.