Data model acceleration is very slow about splunk-apps

[btorresgil]

Do you have the Splunk Enterprise Security App or Splunk Common Information Model App installed?

[hkguy80]

No. Only using Palo Alto App.

[hkguy80]

I am wondering if there is any method to force the Splunk to use more CPU to accelerate the Data Model.

[btorresgil]

There have been several optimizations to the app's datamodel that make it more efficient in summarization performance and disk space usage. I've sent our revised datamodel to the datamodel product managers at Splunk and worked with them to ensure the datamodel in the app is as efficient as possible.

The datamodel in the latest version (currently 5.0.1) is the result of that work, so upgrading to the latest app version will give you the benefits.

If after upgrading you are still experiencing performance issues, this is usually something that needs troubleshooting with Splunk support. The most common issue is not enough hardware resources to handle the quantity of logs being accelerated by the datamodel. Which means the most common fixes are to add more compute resources or reduce the number of logs by being more selective about what is logged to Splunk. However, there can be other issues or optimizations, and Splunk support can help determine the most likely cause of any performance issues.

Closing this issue now based on the optimizations made to the datamodel in the latest app versions.