Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Search
Splunk Community
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Search
Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
94 results
Sort by:
11-26-2018
12:24 PM
Also, what actually does Splunk do when we give the below line in datamodels.conf file?
acceleration.max_concurrent = 1
could someone provide me a basic level understanding of datamodels.conf?
Tuesday
Hi at all, I have an issue on Data Models accelerations: the run times of each accelerations are too high to use DMs in my Correlation Searches: more than 2000 seconds for each run. I have six IDXs...
Labels
- Labels:
-
data model
10-26-2021
02:57 AM
Hi at all, my customer has the requirement to have the "index" field in each DataModel used in ES. Obviously, this additional field doesn't modify CIM compliance but it's needed to make an addition...
- Tags:
- datamodels
- es
Labels
- Labels:
-
using Enterprise Security
05-07-2020
02:18 PM
1 Karma
...now that in datamodels.conf I need to set acceleration.source_guid but that's it. My questions are:
Do I set this on the ES?
Do I use /opt/splunk/etc/system/local/datamodels.conf?
What w...
Labels
- Labels:
-
using Enterprise Security
11-07-2022
02:30 PM
Hello Community
I've been looking at the installation process of Splunk CIM and got stuck on a step.
After installation there seems to be a need to whitelist indexes for datamodels (or vice v...
Labels
- Labels:
-
configuration
10-29-2016
03:18 AM
I've been playing around with the new datasets add-on - it's very slick, well done. Now I want to delete some of the testing tables I created, but there isn't a Delete option in the Data Model Manage...
03-24-2020
08:51 AM
I installed the Fortinet FortiGate App 1.5.1 for Splunk as well as the Fortinet FortiGate Add-On 1.6.2 for Splunk and configured the sourcetype in the props.conf file.
After that I restarted t...
02-22-2022
11:46 AM
...his DM in all 3 Search Head members and Macro too will be updated in all 3 SH members ?
Question 2 - or should i make above changes in "Splunk_SA_CIM" app under "local" folder in macros.conf and datamodels...
Labels
- Labels:
-
data model
10-30-2017
07:04 AM
2 Karma
...xample, I disable acceleration on all of the data models in the app through the UI, then check the local datamodels.conf file and everything's fine except that I still see those datamodel a...
03-23-2023
01:05 PM
1 Karma
...o have this same issue. Nothing in datamodels.conf has changed and the source SH still has the same GUID. Anyone else run into this issue? Running 9.0.4 on all instances in this deployment. Summaries f...
Labels
