When you enable acceleration for a data model, Splunk internally pre-summarizes the data defined by the data model for a given time range. This gives a tremendous boost to the search speed for your data model when searches are executed within the given time range. There are a couple of things to remember when you enable data model acceleration:
- Once you enable acceleration for a data model, you will no longer be able to edit the data model objects. Ensure that your model and related child objects and attributes are accurate before implementing acceleration. A huge data model may take some time to complete the acceleration process, so plan accordingly. You will only be able to edit the data model again if you disable the acceleration.
- Select your summary range wisely. The summary range is the calculation time span that the acceleration will use against...
