(Optional) Configure the advanced acceleration settings.Select the check box next to Accelerate to accelerate the model.Select a data model that you want to accelerate.If you use the CIM without these apps installed, you can choose to accelerate one or more of the data models manually.Ĭonfigure the acceleration parameters of the CIM data models in the CIM Setup view. The modular input overrides the acceleration status that you set on the CIM setup page to make sure that the apps continue to work. Instead, make changes in the Data Model Acceleration Enforcement modular input on your search head. If you use these apps, do not make changes to acceleration settings on the CIM setup page because your changes do not persist. If you have Splunk Enterprise Security or the Splunk App for PCI Compliance installed, configuration settings automatically accelerate some of the data models in the CIM. See Enable data model acceleration in the Knowledge Manager Manual for Splunk Enterprise.Īll data models included in the CIM add-on have data model acceleration disabled by default. The summary range settings of a data model affect the size of the data models on disk and also affect the processing load on the indexers due to the load of creating accelerated data alongside the index buckets. If you constrain a data model to selected indexes and then later add another index to your environment that is also relevant to the data model, return to this page and add the new index to the data model constraints.Įnable acceleration for data models to return results faster for searches, reports, and dashboard panels that reference the data model. You can type the names of indexes that are defined only on indexers. In Indexes whitelist, type the index that the data model should search.Select the data model that you want to modify.Access the setup page directly by going to. Select Apps > Manage Apps and then click Set up in the row for Splunk Common Information Model.In Splunk Web, access the CIM Setup page:.By default, each data model searches all indexes. Improve performance by constraining the indexes that each data model searches. If you do not see a link to set up the app, you can access the setup page directly by going to Set index constraints With Splunk_SA_CIM version 4.12.0 and higher, you need to have the accelerate_datamodel capability. With Splunk_SA_CIM version 4.11.0 and lower, you need to have the admin_all_objects capability. You can only use the setup page on Splunk platform version 6.4.x or later.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |