Reporting

Can we have datamodel acceleration for All Time?

ddrillic
Ultra Champion

When we set the datamodel acceleration, we see the All Time option. Can we truly have data back without limit? How can we measure the storage and processing impact of this setting?

alt text

0 Karma

jnudell_2
Builder

Yes, you can have it accelerated for all time. You would still be limited to the retention period of the index that contributes to the data model. I would be careful with setting it to all time though, because of the disk space usage as you've mentioned.

You could probably get a better answer if you provided a specific use case. Or were you just curious?

ddrillic
Ultra Champion

I guess you are right @jnudell_2 about my real question - what's the relation between the Summary Range of the datamodel and the retention of the index that contributes to the datamodel?

0 Karma

jnudell_2
Builder

As mentioned in the answer, the summary range will not go past the retention limit of the index, because data models are stored in the index folder, and are subject to the retention of the index they're modeling off of. Therefore, even if you set the data model to accelerate for "all time", it would only be for all available time for that particular index given the retention period.

ddrillic
Ultra Champion

Any thoughts on this one, by any chance?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...