I have accelerated my data model for **7 days** period and Rebuild the datamodel.
After its completion, I have executed below query to get the acceleration period which is mentioned in [https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Acceleratedatamodels][1] document under "*Using the summariesonly argument*" section.
| tstats summariesonly=t min(_time) as min, max(_time) as max from datamodel=mydm | eval prettymin=strftime(min, "%c") | eval prettymax=strftime(max, "%c")
As per my understanding, *prettymin* should be 7 days older from the current date but it is showing the timestamp which corresponds to the index time of the very first event (which in my case is approx a month ago.)
Please, help me understand this behavior and let me know if any changes are required to show results in the specified summary range?
[1]: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Acceleratedatamodels
↧