How-To

Setting Up Data Model Acceleration

Step-by-step guide to enabling data model acceleration for optimal performance.

Why Acceleration Matters

Patronus SIEM queries are built on Splunk's Common Information Model (CIM). Without data model acceleration, every dashboard query searches raw events — which is slow at scale.

With acceleration enabled, Splunk pre-computes summaries that dashboards query instantly.

Steps

  1. Navigate to Settings → Data Models in Splunk Web.
  2. Find each of these models:
    • Authentication
    • Network_Traffic
    • Web
    • Endpoint (Processes, Filesystem, Registry)
    • Intrusion_Detection
    • Vulnerabilities
  3. Click Edit → Edit Acceleration.
  4. Check Accelerate.
  5. Set Summary Range to at least 7 days (30 days recommended for trending views).
  6. Click Save.

Verification

After enabling, wait 15–30 minutes for initial summaries to build. Then check:

  • Navigate to Configuration → Performance in Patronus.
  • The data model acceleration section should show "Up to date" for each model.
  • Dashboard load times should drop dramatically.

Troubleshooting

If acceleration appears stuck:

  • Check index=_internal sourcetype=scheduler for errors.
  • Ensure the splunk-system-user has access to the relevant indexes.
  • Verify sufficient disk space for summary data (typically 5–10% of raw data size).
Back to Knowledge Base