Splunk: Enterprise Operational Intelligence Delivered

Accelerating data models

Splunk has several options for optimizing search performance, including summary indexing, report acceleration, and data model acceleration. We will cover both summary indexing and report acceleration later in this book. Data model acceleration helps to speed up reporting for the Object Attributes defined in a data model. This acceleration can then be leveraged by the Pivot tool when reporting.

In this recipe, you will accelerate the data models that we just created in order to familiarize yourself with the process and enhance understanding. Ordinarily, you would only really want to use data model acceleration for reporting on extremely large datasets over a period of time.

Getting ready

To step through this recipe, you will ...