Splunk Search

Why is accelerated data in data-model WEB deleted?

wcwnesta
New Member

When I restart Splunk, accelerated data in data-model WEB is deleted. I update the WEB, then the model gets the data slowly.
if the Splunk restarted, and the data will be deleted again by the Splunk system.
Any one can help me to solve the problem ? thanks a lot !

PS:I choose to keep the accelerated data-model WEB for 3 months. other data-models such as Network Intrusion work well. When the Splunk restarted, the accelerated data kept well.

Tags (1)
0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @wcwnesta, don't forget to accept the answer if this solved your problem. 🙂 It'll award karma points and closed the question. Happy Splunking!

0 Karma

abalogh_splunk
Splunk Employee
Splunk Employee

Hi,

In datamodels.conf you have a setting called acceleration.manual_rebuilds. This defaults to false which means that after each restart your model will be rebuilt if the summaries are incomplete. If you set this to true you need to trigger the rebuild manually.

/opt/splunk/etc/apps/Splunk_SA_CIM/local/datamodels.conf:


[datamodel_name]
acceleration.manual_rebuilds = true

More information: https://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Datamodelsconf

0 Karma

wcwnesta
New Member

Hi abalogh:
Thanks for your answer. My problem is not about acceleration rebuilt.
The WEB has completed summaries, and I can find the file "done"(it marks summaries have been finished) , but the TSIDX file can not be find. So I guess the acceleration works fail for WEB data model.

I copy the WEB data model as WEB2. it works fine.

can you solve my problem? thanks a lot !

0 Karma

abalogh_splunk
Splunk Employee
Splunk Employee

Ok, are you having issues with Splunk SA CIM or a custom WEB data model? Which version of Splunk Enterprise are you using?

0 Karma

wcwnesta
New Member

Hi,the version of Splunk Enterprise is 6.6.3

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...