We are currently using a Splunk Enterprise environment with one search head and one indexer. We enabled datamodelacceleration because the performance of the search became poor as we used the s...
...ACCELERATE_ I accessed the DataModels page and expanded the CIM Validation (S.o.S) datamodel. The information I got is: "Access Count: 0 - Last Access: -) while size is 750MB and frequently updated. My q...
Hi All, I'm not that familiar with DMA as I have not had any exposure really to setting up datamodels so far but am currently having an issue atm with DMA not saying active. We had to disabled D...
Hello folks,
there is a tool that helps in sizing a server that will work with acceleratedatamodels ?
Or wich is the best way to achieve that goal?
It seams that splunk base configuration 1...
Not sure where & how to address the below skipped job. I would appreciate any guidance Report Name Skip Reason (Skip Count) Alert Actions _ACCELERATE_DM_SA-IdentityManagement_I...
My Splunk architecture is having 8 Searchheads in a cluster and 40 indexers in a cluster.
If i have to accelerate the datamodels, i have to update datamodels.conf in all the searchheads. So, I a...
...models, I have a question regarding the storage location and method of accelerated data. If the data is accelerated, does the datamodel summary folder store the complete accelerated data or will i...
Hello Im running splunk datamodelacceleration And it stopped working. It is stuck in skipping and nothing happens With “summariesonly=true” i get no results but if i set it to false i get r...
Hi guys -
I have 3 datamodels, all accelerated, that I would like to join for a simple count of all events (dm1 + dm2 + dm3) by time.
3 single tstats searches works perfectly.
Search 1
| t...
I know that I can get the current size of an accelerated datamodel using REST or just using the web GUI under settings "Datamodels", but how can I see the historical (disk) size of the accelerate...