How to get details of accelerated datamodels that failed to complete?

[Taruchit]

Hello All,

I need help to build an SPL for finding details of Accelerated Data Models which have failed to execute or failed to complete.

I have used rest command to fetch details of data models, but I am unable to find any fields that share if and when it failed. 

|rest /servicesNS/nobody/-/datamodel/model splunk_server=local
|rex field=acceleration "\{\"enabled\"\:(?<acceleratedValue>[^\,]*)"
|search acceleratedValue=true

Thus, it would be very helpful to seek your suggestions and approach.

Thank you
Taruchit

[paulcurry · Accepted solution]

Perhaps the SPL from https://hurricanelabs.com/splunk-tutorials/how-to-improve-your-data-model-acceleration-in-splunk/?

I won't post it here since it's fairly large but running it in my environment listed all the details of the data models and completion percentage.

[Taruchit]

Hi @paulcurry,

Thank you for sharing the resource.

I do get the results with following fields: -

• datamodel
• acceleration_enabled
• complete(%)
• size(MB)
• correlation_searches_enabled
• access_time

In the SPL, there are some macros: -

datamodel()

drop_dm_object_name()

My questions are: -

1) Can you please help to share the details about the above two macros?

2) And do you know about any other approach of fetching details of accelerated datamodels apart from the one you shared previously?

Thank you

[paulcurry]

1. Those are built-in OOB macros.  You can view them in "Settings-Advanced Search-Search Macros"

2. Sorry, I don't unless you look at "Settings-Data Models".  The ones with yellow lightning bolts are the accelerated ones.  You can expand those in there and see some details.

[Taruchit]

Thank you for sharing.