Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
66 results
Sorted by:
11-26-2018
12:24 PM
Also, what actually does Splunk do when we give the below line in datamodels.conf file?
acceleration.max_concurrent = 1
could someone provide me a basic level understanding of datamodels.conf?
03-24-2020
08:51 AM
I installed the Fortinet FortiGate App 1.5.1 for Splunk as well as the Fortinet FortiGate Add-On 1.6.2 for Splunk and configured the sourcetype in the props.conf file.
After that I restarted t...
05-14-2020
09:57 AM
Hello,
I have a question about modification of data model in CIM:
I would like to add one child dataset to DM "Change". Can I do it by separate application?
What I mean exactly: If I create a m...
Labels
10-30-2017
07:04 AM
1 Karma
...xample, I disable acceleration on all of the data models in the app through the UI, then check the local datamodels.conf file and everything's fine except that I still see those datamodel a...
03-09-2020
09:06 AM
We have 2 separate search clusters fed by the same index cluster.
The reason to have two search clusters was to host 2 sets of apps/add-ons that serve 2 different functional groups.
Now we are...
03-24-2018
06:31 PM
My Splunk architecture is having 8 Searchheads in a cluster and 40 indexers in a cluster.
If i have to accelerate the data models, i have to update datamodels.conf in all the searchheads. So, I a...
10-29-2016
03:18 AM
I've been playing around with the new datasets add-on - it's very slick, well done. Now I want to delete some of the testing tables I created, but there isn't a Delete option in the Data Model Manage...
01-28-2015
08:34 AM
2 Karma
I have an app with an accelerated data model. The data model is defined in a JSON file while the acceleration is enabled in datamodels.conf .
Splunk's documentation explains that a persistently a...
10-29-2018
01:34 PM
...plunkSACIM/local/datamodels.conf with all datamodels set to acceleration = true
It seems to break the whole model of "put things in your local directory so they won't be touched during an upgrade"
In a...
10-09-2019
03:45 AM
...emoved everything else. Not sure if there is any other files needed to stop rebuilding datamodels.
app.conf
datamodels.conf
eventtypes.conf
indexes.conf
props.conf
transforms.conf
Thanks
