Reporting

Why is my Data Model not consistently returning data?

user4455
Explorer

I have a data model with FW and Apache logs in it. It's set for 7 days and Accelerated. The problem is with the web logs. I can use the pivot tool and try and view the last 7 days based on the http_status_code and it will return 0 results. A few minutes later, I do it again and all the data is there. Later on, it will be gone again. The Data Model says it is 100%. There is data consistently every day too.

It feels like the data is not being loaded or kept in the model.

Anyone have any tips?

Thanks

hunters_splunk
Splunk Employee
Splunk Employee

Hi user4455,

Seems that your search is returning data very slowly, which shouldn't be the case with accelerated data models. You can run the following search to see how many events your search is scanning.

| tstats count from datamodel=<your_data_model>
by http_status_code
| sort -count

Also, try this command that generates results from the TSIDX data automatically generated by the acceleration, unsummarized data is not included:

| tstats count from datamodel=AccButtercup_Games_Online_Sales
summariesonly=t

Hope this helps. Thanks!
Hunter

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...