Splunk® Common Information Model Add-on

Common Information Model Add-on Manual

Acrobat logo Download manual as PDF

This documentation does not apply to the most recent version of CIM. Click here for the latest version.
Acrobat logo Download topic as PDF

Accelerate CIM data models

You can accelerate a data model to speed up the data set represented by that data model for reporting purposes. After you accelerate a data model, your reports and dashboard panels that reference the accelerated data model will return results faster. A data model's summary range setting effects the size of the data models on disk, and the processing load of creating accelerated data objects alongside the index buckets. For more information about accelerating data models, see Enable data model acceleration in the Knowledge Manager Manual for Splunk Enterprise.

By default, the data model acceleration for all models included in the Splunk Common Information Model Add-on are disabled. To accelerate a data model:

  1. In Splunk Web, click Settings and select Data models.
  2. Select a data model that you want to accelerate.
  3. Under Acceleration, click Add next to the status "Model is not accelerated."
  4. Click the check box to accelerate the model.
  5. Set a Summary Range.
  6. Select Save.

Apps or add-ons that depend on data models (for example, Splunk Enterprise Security) may require that the data models be accelerated in order for their reports and dashboards to work.

For more information about accelerated data models and data model acceleration jobs, use the Data Model Audit dashboard included in the Common Information Model Add-on, or run the datamodelinfo command.

Last modified on 14 March, 2016
Use the CIM to create reports and dashboards
Use the CIM to normalize OSSEC data

This documentation applies to the following versions of Splunk® Common Information Model Add-on: 4.1.0, 4.1.1, 4.2.0, 4.3.0, 4.3.1

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters