Accelerate Splunk Searches with Data Model Acceleration: Enable, Configure, and Use tstats

Why Accelerate a Splunk Data Model?

When you enable acceleration for a data model, Splunk builds a summary index that pre‑aggregates the objects defined in the model. Queries that use the tstats command can then read from this compact index instead of scanning every raw event, cutting search time from minutes to seconds for large time ranges.

Step 1 – Enable Acceleration

Acceleration can be turned on either through Splunk Web or by editing datamodels.conf. The key setting is acceleration = true and you must define a summaryIndex and an accelerationWindow (the number of days of data kept in the summary).

Using Splunk Web

1. Navigate to Settings → Data Models.
2. Choose the model you want to accelerate and click Edit.
3. Check the Acceleration box, set the Window (e.g., 7d) and select or create a Summary Index (e.g., summary_app_state).
4. Save and click Rebuild Acceleration to start the initial build.

Using datamodels.conf

[ApplicationState]
acceleration = true
summaryIndex = summary_app_state
accelerationWindow = 7d

Place this stanza in the appropriate datamodels.conf file on the indexer or search head cluster, then reload the configuration or restart Splunk to apply.

Step 2 – Verify Acceleration Is Active

After rebuilding, confirm that the summary index contains data and that acceleration status is “Active”.

1. Via Splunk Web: Go to Settings → Data Models → Acceleration and look for the status column.
2. Via REST API: curl -k -u admin:changeme https://localhost:8089/services/data/model/acceleration/ApplicationState – the JSON response will contain status: "Active".
3. Check the size of the summary index: | tstats count FROM datamodel=ApplicationState – the count should be high and the query runs quickly.

Step 3 – Query with tstats

The tstats command reads from the accelerated summary index. A typical query aggregates event counts by hour for a specific node in the model.

| tstats count
  FROM datamodel=ApplicationState
  WHERE nodename=ApplicationState.Transaction AND status=success
  BY _time span=1h
  | rename _time as hour
  | table hour, count

Replace status=success with any field defined in the model’s objects. Because the data is pre‑aggregated, this query will finish in a fraction of a second even over a week of data.

Limitations and Common Pitfalls

• Field Scope: Only fields that appear in the model’s objects are summarized. If you reference a field that isn’t part of the model, tstats will fall back to raw events, negating the speed benefit.
• Acceleration Window: Data older than the window is purged from the summary index. Queries that need historical data beyond the window will be slow or return incomplete results. Increase accelerationWindow if you need longer retention, but be aware of disk usage.
• Rebuilding After Model Changes: Adding or removing objects from the model does not automatically update the summary index. You must click Rebuild Acceleration or run the REST endpoint /services/data/model/acceleration//rebuild to refresh.
• Disk Space: A large acceleration window on a busy model can consume gigabytes of storage. Monitor $SPLUNK_HOME/var/lib/splunk/summary and set index retention policies accordingly.
• Permission Requirements: Only users with the admin role or those granted the data_model_acceleration capability can enable or rebuild acceleration.

Practical Check: Confirm tstats Uses the Summary Index

To ensure that tstats is pulling from the accelerated index, compare the searchMode in the search job details.

1. Run a tstats query and open the Job Inspector.
2. Look for the searchMode: "accelerated" entry. If it says searchMode: "raw", the query is not using the acceleration.

Alternatively, run:

| tstats count FROM datamodel=ApplicationState
  | where _time > relative_time(now(), "-1h@h")
  | eventstats sum(count) as total
  | where total > 0

If the job completes in ~0.1s versus ~10s for a raw search, acceleration is working.

When to Use Acceleration vs. Raw Searches

• Use acceleration when you need fast, repeated aggregations over large time spans and the queried fields are defined in the model.
• For ad‑hoc searches that reference many raw fields or need very recent data beyond the window, raw searches (or the search command) are still appropriate.

Conclusion

Data model acceleration is a powerful tool for speeding up Splunk searches that fit the model’s structure. Enable it carefully, monitor disk usage, rebuild after model changes, and always verify that tstats is hitting the accelerated summary index. With these practices, you’ll see search times drop dramatically while maintaining accurate, up‑to‑date analytics.