Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
84 results
Sorted by:
11-26-2018
12:24 PM
Also, what actually does Splunk do when we give the below line in datamodels.conf file?
acceleration.max_concurrent = 1
could someone provide me a basic level understanding of datamodels.conf?
10-26-2021
02:57 AM
Hi at all, my customer has the requirement to have the "index" field in each DataModel used in ES. Obviously, this additional field doesn't modify CIM compliance but it's needed to make an addition...
- Tags:
- datamodels
- es
Labels
- Labels:
-
using Enterprise Security
...his DM in all 3 Search Head members and Macro too will be updated in all 3 SH members ?
Question 2 - or should i make above changes in "Splunk_SA_CIM" app under "local" folder in macros.conf and datamodels...
Labels
- Labels:
-
data model
05-07-2020
02:18 PM
1 Karma
...now that in datamodels.conf I need to set acceleration.source_guid but that's it. My questions are:
Do I set this on the ES?
Do I use /opt/splunk/etc/system/local/datamodels.conf?
What w...
Labels
- Labels:
-
using Enterprise Security
03-24-2020
08:51 AM
I installed the Fortinet FortiGate App 1.5.1 for Splunk as well as the Fortinet FortiGate Add-On 1.6.2 for Splunk and configured the sourcetype in the props.conf file.
After that I restarted t...
10-29-2016
03:18 AM
I've been playing around with the new datasets add-on - it's very slick, well done. Now I want to delete some of the testing tables I created, but there isn't a Delete option in the Data Model Manage...
05-14-2020
09:57 AM
Hello,
I have a question about modification of data model in CIM:
I would like to add one child dataset to DM "Change". Can I do it by separate application?
What I mean exactly: If I create a m...
Labels
- Labels:
-
configuration
10-30-2017
07:04 AM
2 Karma
...xample, I disable acceleration on all of the data models in the app through the UI, then check the local datamodels.conf file and everything's fine except that I still see those datamodel a...
05-06-2019
12:49 PM
Hello,
We are going to setup some reports to use acceleration using Summary Range of 7 days. Question, how often will Splunk behinds the scene keep the data in the 7 days range. Does Splunk accele...
- Tags:
- acceleration
- report
03-09-2020
09:06 AM
We have 2 separate search clusters fed by the same index cluster.
The reason to have two search clusters was to host 2 sets of apps/add-ons that serve 2 different functional groups.
Now we are...
