We are currently using a Splunk Enterprise environment with one search head and one indexer. We enabled datamodelacceleration because the performance of the search became poor as we used the s...
...ACCELERATE_ I accessed the DataModels page and expanded the CIM Validation (S.o.S) datamodel. The information I got is: "Access Count: 0 - Last Access: -) while size is 750MB and frequently updated. M...
Hi All, I'm not that familiar with DMA as I have not had any exposure really to setting up datamodels so far but am currently having an issue atm with DMA not saying active. We had to disabled D...
Not sure where & how to address the below skipped job. I would appreciate any guidance Report Name Skip Reason (Skip Count) Alert Actions _ACCELERATE_DM_SA-IdentityManagement_I...
My Splunk architecture is having 8 Searchheads in a cluster and 40 indexers in a cluster.
If i have to accelerate the datamodels, i have to update datamodels.conf in all the searchheads. So, I a...
Hello Im running splunk datamodelacceleration And it stopped working. It is stuck in skipping and nothing happens With “summariesonly=true” i get no results but if i set it to false i get r...
Hi guys -
I have 3 datamodels, all accelerated, that I would like to join for a simple count of all events (dm1 + dm2 + dm3) by time.
3 single tstats searches works perfectly.
Search 1
| t...
I have an accelerated CIM datamodel. The indexes used to populate the datamodel (and accelerated summaries) are defined by a macro (a typical CIM approach - cim_Email_indexes, c...
...he datamodel The problem we have is that when we enter a new user in the loockup, if the datamodel is accelerated, it never updates the information for this new user, if we do not accelerate the data...
...ndexers, with datamodels. On the indexers i can see the datamodels accelerated and they have a size, this makes sence and the data comes into the indexers->indexs and it is accelerated.
I also h...