When we start the acceleration of data model, it completes successfully. But when we run the below query, we are not able to fetch the data.
| tstats summariesonly=t count from datamodel="datamodel_name"
It gives the 0 counts.
But when we run the following query we are able to fetch the data.
| tstats summariesonly=false count from datamodel="datamodel_name"
it gives the 1034 count.
So please let me know if I am doing something wrong.
NOTE:
We have checked the acceleration period and it has the data.
Splunk version : 6.5.3
And I am facing this issue on specific instance only.
↧