Configure data model acceleration

Splunk Analytics for Hadoop reaches End of Life on January 31, 2025.

By default only users with permissions to access the data on the Hadoop cluster can create data models.

Create a data model

1. Navigate to Settings > Data Models.

2. Click the Manage Data Models button.

3. Click New Data Model.

4. In the Create New Data Model dialog, enter the data model Title and optional Description. The Title field can accept any character except asterisks, including blank spaces between characters. This title appears wherever the data model name is displayed.

5. Splunk Analytics for Hadoop populates the data model ID field with a unique ID as you enter the title. You do not need to edit this ID. If for any reason, you find that you must edit this field, note the following:

• It must be a unique identifier.
• It can only contain letters, numbers, and underscores.
• It cannot contain spaces between characters

Once you click Create you can't change the ID value.

6. App will display the app context that you are in currently,

7. Click Create to open the new data model in the Data Model Editor.

8. Add and define the objects you want included in the search. To define the data model's first object, click Add Object and select an object type. For more information about object definition, see Design data models in the Splunk Enterprise Knowledge Manager Manual.

Accelerate the data model

1. Open the Data Model Editor for a data model, click Edit and select Edit Acceleration.

2. Select Accelerate. Note that when creating an accelerated model, Hadoop node usage increases.

3. Choose a Summary Range for your accelerated data model search.

4. Enable Specific Options: Checking this box lets you edit file information. Only check this if you want to change the default values. Splunk Analytics for Hadoop populates the following fields based on the information found in the data model, so it may not be necessary to edit them.

• File Format: Chose either Parquet or Orc.

• Compression codec: For Parquet file format, choose Snappy or Gzip. For Orc, select Snappy or zlib.

• DFS block size: Check Enable Block Size specification, then determine a size. Note that the DFS block size must be at least 32MB. Orc and Parquet must buffer record data in memory until those records are written. Memory consumption should correlate to the size of all the columns of a row group in your search. In other words, the fewer required fields in your search, the less buffer memory is required.