I have a data model in Splunk with a root event and two child events. The child events have a constraint that uses a calculated field. When I search the child events, only recent data is returned. This only happens when data model acceleration is enabled.
The child constraint: latency>0
**Example**
When I count the total number of events, the total is always correct:
| tstats count from datamodel=dmdemo.rooteventdemo where nodename=rooteventdemo
Results: 580,220
Which is roughly the same as:
| datamodel dmdemo rooteventdemo search
Results: 580,704
However, when I search the child:
| tstats count from datamodel=dmdemo.rooteventdemo where nodename=rooteventdemo.child1
Results: 0.
Which is the same as:
| datamodel dmdemo child1 search
Results: 0
Note: these values change continuously when I search for the latest 15 min.
When I disable report acceleration, tstats obviously doesn't work but the search is working fine again:
| tstats count from datamodel=dmdemo.rooteventdemo where nodename=rooteventdemo.child1
Results: 0
| datamodel dmdemo child1 search
Results: 474,045
The total result is as expected:
| datamodel dmdemo rooteventdemo search | search rooteventdemo.field1>0
Results: 474,045
| datamodel dmdemo rooteventdemo search | where 'rooteventdemo.field1'>0
Results: 474,045
I've also created a new data model where the calculated field is used as a root event. This is still causing the same issues, so the issue is not caused because it's a child data set.
Does anyone know what is causing this and how to fix it? I've thought of simply sending the calculated field to Splunk or perhaps to create the calculated field at index time, but I think Splunk data models should be able to cope with calculated fields.
↧