Why is accelerated data in data-model WEB deleted?

[wcwnesta]

When I restart Splunk, accelerated data in data-model WEB is deleted. I update the WEB, then the model gets the data slowly.
if the Splunk restarted, and the data will be deleted again by the Splunk system.
Any one can help me to solve the problem ? thanks a lot !

PS：I choose to keep the accelerated data-model WEB for 3 months. other data-models such as Network Intrusion work well. When the Splunk restarted, the accelerated data kept well.

[lfedak_splunk]

Hey @wcwnesta, don't forget to accept the answer if this solved your problem. 🙂 It'll award karma points and closed the question. Happy Splunking!

[abalogh_splunk]

Hi,

In datamodels.conf you have a setting called acceleration.manual_rebuilds. This defaults to false which means that after each restart your model will be rebuilt if the summaries are incomplete. If you set this to true you need to trigger the rebuild manually.

/opt/splunk/etc/apps/Splunk_SA_CIM/local/datamodels.conf:

[datamodel_name]

acceleration.manual_rebuilds = true 

More information: https://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Datamodelsconf

[wcwnesta]

Hi abalogh:
Thanks for your answer. My problem is not about acceleration rebuilt.
The WEB has completed summaries, and I can find the file "done"(it marks summaries have been finished) , but the TSIDX file can not be find. So I guess the acceleration works fail for WEB data model.

I copy the WEB data model as WEB2. it works fine.

can you solve my problem? thanks a lot !

[abalogh_splunk]

Ok, are you having issues with Splunk SA CIM or a custom WEB data model? Which version of Splunk Enterprise are you using?

[wcwnesta]

Hi，the version of Splunk Enterprise is 6.6.3