How to delete data from the data model and force it to rebuild ?

[DavidHourani]

Hello,

I am trying to clear my data model but I can't seem to get it to rebuild. Every time i click rebuild I get the same data I had before the rebuild even though the event that is being accelerated has changed.

Any idea how I can delete everything in the data model or at least try to get the new data to be taken into account ?

Best regards,
David

[aljohnson_splun · Accepted solution]

Splunk Enterprise automatically rebuilds summaries when you disable and then reenable acceleration for a summary (to edit the data model, for example) - here

• Click Update to refresh the acceleration summary detail information.

- Click Edit to open the Edit Acceleration dialog and change the Summary Range or disable acceleration for the data model altogether.

Now if you still want to delete it:

First, make sure you back up your data model by clicking Download in the top right while editing the data model objects.

Secondly, see this portion on how to delete the data model.

Thirdly, upload your data model again and rebuild the acceleration.

[DavidHourani]

Thanks for your answer Aljohnson, In fact I was only disabling/enabling the DM and then rebuilding it but that wasn't helping. In order to force it to rebuild the acceleration period must be modified it seems or else the DM would simply keep the same data.