In the Table Datasets Acceleration [documentation][1], it lays out the process of accelerating a table dataset datamodel object. Because Table Datasets differ from normal data models, they have to be created through the Table Datasets Addon in the search app.
After creating a Table Dataset, I moved the Table Dataset datamodel object to the app I wanted it to live in, then accelerated it. Currently, I can access the datamodel in a '| tstats' pipe by using the following:
| tstats summariesonly=true avg(foo) FROM datamodel:My_TableDataset
Which, according to the [Accelerate Datasets documentation][2], does not leverage the benefit of acceleration due to syntax:
"To do this, you identify the data model using FROM datamodel=:"
Events are being populated correctly in the datamodel, also viewable when using Pivot.
Whenever I try to use the correct 'datamodel=My_TableDataset' syntax, I get the following error:
"Error in 'TsidxStats': Invalid or unaccelerable root object for datamodel"
Because Table Datasets aren't created/defined the same way as normal datamodels, what does this mean? How do I troubleshoot this issue and access the accelerated table benefits from this dataset?
Info from the Data Model settings page:
MODEL
- Datasets ... 1 Search Event
- Permissions ... Shared Globally. Owned by nobody.
ACCELERATION
- Status ... 100% Completed.
Type = table
[1]: http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Acceleratetables
[2]: http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Acceleratedatamodels
↧