Reporting

What is the data model acceleration default cron schedule?

the_wolverine
Champion

I have data model acceleration enabled and have seen that the data model is not keeping up with the raw data (my dashboards populated by tstats are not showing recent data and can be behind by 1 hour). The datamodels.conf stanzas do not contain a cron. So I'm wondering if there is a default schedule is being used -- and if so -- what is is that schedule?

According to data models.conf.spec:

acceleration.cron_schedule = <cron-string>
* Cron schedule to be used to probe/generate the column stores for this data model

Should I set up a cron to run every minute? Every 5 minutes? What is the suggested schedule?

MuS
SplunkTrust
SplunkTrust

Hi the_wolverine,

the default interval is 5 minutes, where Splunk runs a search to update existing data model summaries. It runs a maintenance process every 30 minutes to remove old, outdated summaries. See the docs http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Acceleratedatamodels#After_you_enable_ac...

Before decreasing the interval; I would check if the data model acceleration summary search runs without error and on time, see the docs on this http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Acceleratedatamodels#How_Splunk_Enterpri...

Hope this helps ...

cheers, MuS

somesoni2
SplunkTrust
SplunkTrust

As per documentation, it's getting updated every 5 min. See the 2nd para from below link.

http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Acceleratedatamodels#After_you_enable_ac...

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...