Splunk Search

Why is accelerated data in data-model WEB deleted?

wcwnesta
New Member

When I restart Splunk, accelerated data in data-model WEB is deleted. I update the WEB, then the model gets the data slowly.
if the Splunk restarted, and the data will be deleted again by the Splunk system.
Any one can help me to solve the problem ? thanks a lot !

PS:I choose to keep the accelerated data-model WEB for 3 months. other data-models such as Network Intrusion work well. When the Splunk restarted, the accelerated data kept well.

Tags (1)
0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @wcwnesta, don't forget to accept the answer if this solved your problem. 🙂 It'll award karma points and closed the question. Happy Splunking!

0 Karma

abalogh_splunk
Splunk Employee
Splunk Employee

Hi,

In datamodels.conf you have a setting called acceleration.manual_rebuilds. This defaults to false which means that after each restart your model will be rebuilt if the summaries are incomplete. If you set this to true you need to trigger the rebuild manually.

/opt/splunk/etc/apps/Splunk_SA_CIM/local/datamodels.conf:


[datamodel_name]
acceleration.manual_rebuilds = true

More information: https://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Datamodelsconf

0 Karma

wcwnesta
New Member

Hi abalogh:
Thanks for your answer. My problem is not about acceleration rebuilt.
The WEB has completed summaries, and I can find the file "done"(it marks summaries have been finished) , but the TSIDX file can not be find. So I guess the acceleration works fail for WEB data model.

I copy the WEB data model as WEB2. it works fine.

can you solve my problem? thanks a lot !

0 Karma

abalogh_splunk
Splunk Employee
Splunk Employee

Ok, are you having issues with Splunk SA CIM or a custom WEB data model? Which version of Splunk Enterprise are you using?

0 Karma

wcwnesta
New Member

Hi,the version of Splunk Enterprise is 6.6.3

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...