I have several questions about data architecture that are rooted in CIM datamodels and performance considerations.
Background: We have about 2T of new log data every day. Some sourcetypes get 1...
...onf2014_DavidClawson_Splunk_how to actually use datamodels
Learn How to Design, Build and Manage DataModels
Splunk-6.4.3-SearchReference-Datamodel
I am at a loss those on how to start. I have played around with t...
Not sure where & how to address the below skipped job. I would appreciate any guidance Report Name Skip Reason (Skip Count) Alert Actions _ACCELERATE_DM_SA-IdentityManagement_I...
...tats sum(Megabytes) as Megabytes by user dest_nt_host |eval Megabytes=round(Megabytes,3)| sort -Megabytes| fields user dest_nt_host Megabytes|head 10
Converting into tstats
(| tstats count from data...
I have a datamodel that has grown quite large, over 7TB for Network Sessions. Its set to 3 months accelerated. I want to change it 7 days but I'm not sure it will remove the rest of the data s...
My Splunk architecture is having 8 Searchheads in a cluster and 40 indexers in a cluster.
If i have to accelerate the datamodels, i have to update datamodels.conf in all the searchheads. So, I a...
Dear Experts,
Kindly help to modify Query on DataModel, I have built the query.
| tstats summariesonly dc(All_Traffic.src) as src_count from datamodel=Network_Traffic where * by A...
Hello Im running splunk datamodel acceleration And it stopped working. It is stuck in skipping and nothing happens With “summariesonly=true” i get no results but if i set it to false i get r...
Hi all,
I am trying to use datamodels to extract a search time value from a lookup. However, the value I am using to join to the lookup table is extracted from the source. I have no other way t...