Search

BernardEAI · ‎04-23-2021

...619093900). It looks like the _time field is truncated to have only seconds. Is this according to design for accelerated data models? Is there a way to have a _time field in UNIX format with micro seconds?

joshbeckett · ‎05-14-2020

I have several questions about data architecture that are rooted in CIM data models and performance considerations. Background: We have about 2T of new log data every day. Some sourcetypes get 1...

_jgpm_ · ‎01-23-2017

...onf2014_DavidClawson_Splunk_how to actually use data models Learn How to Design, Build and Manage Data Models Splunk-6.4.3-SearchReference-Datamodel I am at a loss those on how to start. I have played around with t...

OL · ‎12-12-2013

...d'hoc searches. The problem I see is if I design a datamodel on the first server and accelerate it, I cannot use the benefit of the acceleration from the second server. Anyone know if there is a way to d...

simpkins1958 · ‎01-04-2018

Trying to understand the difference between Data Models and Datasets and when to use one vs. the other?

bapun18 · ‎11-01-2019

Hi I want to improve my search for better search performance, please find the attachment enclosed.![alt text

a212830 · ‎11-12-2014

Why is | tstats count where index=* by sourcetype so much faster than index=* | stats count by sourcetype ?

splunk24 · ‎08-22-2015

In our multisite cluster, we have two sites: site1 and site 2 We are using data model acceleration and are facing issues in getting updated accelerated data models available in both sites. There i...

aubine · ‎08-27-2020

...t eventually got shipped into Production (with no changes). The server is old and is needs to be evergreened. My question is this: If you could design a new system, what would you go with? I have the p...

lightech1 · ‎01-20-2019

Hello Community! When we do some search in CIM syntax with Splunk 6.6.x , we saw the CIM fields like por example : Al_traffic.xxx and also the basic fields like src_ip , src_port and the Splunk_se...

Search

Search the Community

Data model _time field format

Questions about data models, data architecture, an...

Should I use root events, root transactions, or ro...

datamodel acceleration on multiple search heads

Data Model vs. Datasets - when to use?

How to improve performance of stats sum

What is tstats and why is so much faster than stat...

In a multisite cluster, how do we make updated acc...

Designing a Splunk Refresh for very non-standard e...

Splunk_server field is not available when we searc...