If you have a table dataset that contains a large amount of data, you can accelerate it so that searches, reports, and dashboard panels that use or extend it return results quicker than they would otherwise.
Table acceleration follows the same principles as data model acceleration. In fact, the Splunk software treats each table dataset as it it were a data model made up of a single root search data model dataset.
See Design data model datasets for more information about root search data model datasets.
Things to know about table acceleration
Before you accelerate your table datasets, there are some restrictions you should be aware of.
- The benefits of acceleration are only available to tables when you apply the
pivotcommands to them. This means that you see the acceleration benefits when you run a search that uses those commands to reference a table. You also see acceleration benefits when you use the Pivot editor to create a report or dashboard panel that uses an accelerated table. You will not see acceleration benefits when you use a command like
fromto reference an accelerated table.
- By default, only users whose roles have the
accelerate_datamodelcapability can accelerate data models. Table acceleration can be resource-intensive, so it should be used conservatively by a limited number of Splunk users.
- You cannot enable acceleration for private tables. You must share a table to make it eligible for acceleration. When you do this, you need to share related knowledge objects (such as lookup tables and lookup definitions that your lookup fields are dependent upon) as well, in exactly the same way. See "About data model permissions," above, for more information.
- If you want to accelerate a table that extends other tables, you must share those extended tables as well. See Dataset extension.
- If you edit an accelerated table, the Splunk software will rebuild its acceleration summary when you save your changes. When you change a dataset definition, its summary becomes invalid and must be replaced.
- You can apply table acceleration only to tables that use purely streaming commands. If you have applied the Limit Rows, Remove Duplicates or Stats commands to your table, it cannot be accelerated.
- You cannot accelerate a table that is extended from a lookup file or lookup definition. Lookup dataset extension is not a streaming operation.
- Table acceleration is most efficient if the table being accelerated specifies the index(es) to be searched in its initial constraint search. Otherwise the Splunk software searches all available indexes for the table and may waste time and resources accelerating data that you do not care about.
For details about how table acceleration works and tips on managing table acceleration summaries, see Accelerate data models.
To accelerate a table dataset
Use the Data Models management page in Settings to manage table dataset acceleration.
- Select Settings > Data Models to go to the Data Models listing page.
- Find the dataset you want to accelerate and open its acceleration controls. Use one of the following options.
Option Additional steps for this option Select Edit > Edit Acceleration. None Expand the row for the table. Click Add for ACCELERATION.
- Select Accelerate to enable acceleration for the table.
- Select a Summary Range of 1 Day, 7 Days, 1 Month, 3 Months, 1 Year, or All Time, depending on the range of time over which you plan to run searches, reports, or dashboard panels that use the accelerated table. For example, if you plan to only run dashboard panels using the table over periods of time that fall within the last seven days, choose 7 Days.
If you require a different summary range than the ones supplied by the Summary Range field, you can configure it for your table in
- Click Save to save your acceleration settings.
Once your table is accelerated, the "lightning bolt" symbol for the table on the Data Models management page will be lit up with a yellow color.
Inspect table acceleration metrics
After you accelerate a table you can find its acceleration metrics on the Data Models management page. Just expand the row for the accelerated table and review the information that appears under ACCELERATION.
|Status||Tells you whether the acceleration summary for the table is complete. When the summary is in Building status you also see what percentage of the summary is complete. Many table summaries are constantly updating with new data. This means that a summary that is "complete" now may be "building" later.|
|Access Count||Shows you how many times the table summary has been accessed since it was created, and when the last access time was. Useful when you are trying to determine which accelerated tables are not being used frequently. Because table acceleration uses system resources, you may not want to accelerate tables that are not regularly accessed.|
|Size on Disk||Shows you how much disk space the table acceleration summary takes up. Use this metric along with the Access Count to determine which summaries are unnecessary and should be deleted. If a table acceleration summary is taking up a large amount of disk space, consider reducing its summary range.|
|Summary Range||Presents the range of the table acceleration summary, in seconds, always relative to the present moment. You set this range when you enable acceleration for the table.|
|Buckets||Displays the number of index buckets spanned by the table acceleration summary.|
Click Rebuild to rebuild the summary from scratch. You may want to do this in situations where you suspect there has been data loss due to a system crash or similar mishap. Splunk Enterprise automatically rebuilds summaries when you edit a table, or when you disable and reenable table acceleration.
Click Update to refresh the acceleration summary detail information.
Click Edit to open the Edit Acceleration dialog and change the Summary Range or disable acceleration for the table.
About data models
This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4