Greetings fellow Splunkers,
Our client wants dashboards, reports, and alerts that provide comprehensive statistics in real-time and the ability to quickly view trends over time. Even a five-second load time for any of the dashboards irks them. Simple enough.
To meet that demand, we've created a **[summary index](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Configuresummaryindexes)** that captures virtually all data metrics available to us. We've built an **[accelerated data model](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Acceleratedatamodels)** ([datamodels.conf](https://docs.splunk.com/Documentation/Splunk/latest/Admin/DataModelsConf)) on top of that normalized summary index. That's all well and good - the client is happy with all of the pivot-powered dashboards/alerts/reports.
However, I have yet to find any useful detailed documentation about data model acceleration. Our problem now is being 100% sure that no data is missed. The saved searches to populate the summary index run every five minutes at let's say `*/5` (:00, :05, :10, etc.). The Summarization Period of the data model is set to let's say `1-59/5` (:01, :06, :11, etc.). Assuming none of those take more than one minute to run (they don't), I believe the math works out that alerts should look back 7 minutes (1:00 to populate summary index for 0:55-1:00, 1:01 to populate data model for 0:56-1:01, 1:02 to run the alert from 0:55-1:02). Rinse and repeat every 5 minutes. Again, assuming nothing takes longer than one minute to run and everything is configured as I claim it is, is my math correct? Is there ever a situation where an event is missed between alerts?
I am aware of the [Splunk Operational Intelligence Cookbook](https://books.google.com/books?id=cHteDwAAQBAJ) which simply mentions "Summarization Period". Besides that and the links in my post, I can't find any useful documentation. The documentation linked repeatedly claims that data model acceleration searches run every 5 minutes, however, the "Summarization Schedule" option (being defined by a cron schedule) implies that this is up to the admin. After changing the summarization schedule in dev, I've confirmed that the `_ACCELERATE_DM` scheduled search obeys the Summarization Schedule cron schedule ( `acceleration.cron_schedule` in datamodels.conf).
I am aware of **[Metrics Indexes](https://docs.splunk.com/Documentation/Splunk/latest/Metrics/Overview)**. We will be moving in that direction in the future.
Cheers,
Jacob
↧