Data Models, Acceleration, and Other Ways to Improve Performance

In this chapter, we will shift gears and look at ways we can improve performance in Splunk. We will introduce concepts such as datasets, lookups, and data models in Splunk. Datasets, lookups, and data models are all logical ways of storing data in Splunk to improve search performance. In addition, data models can be accelerated – that is, data in the data model is stored with indexed fields. These additional indexed fields can be specified in searches using special commands such as the Splunk tstats command. The tstats command can be used with aggregate functions such as avg() and earliest(). We will learn different terms associated with data models such as constraints, root events, and child searches. The Splunk Common Information Model (CIM) add-on is a useful add-on that comes preconfigured with data models that, when implemented properly, improve Splunk’s performance. We will explore the different data...