Accelerated data model getting suppressed.

Applicability

Description

In this, the accelerated data model is set for 3 months and the data is also present in the data model so that whenever search the accelerated data model the data for 3 months should be seen, but over here the data for the last 15 or 20 days were seen and the remaining data is getting suppressed.
 

In the above screenshot, search the data for the last 3 months, but the for the last 20 days were visible and the remaining day's data were suppressed.

Investigation

The different storage locations that the volume for the hot and cold index was pretty high but the storage for the splunk_summaries index was pretty low i.e. 51 GB as seen in the below screenshot.
 

Resolution

When using accelerated data model the summaries of the data would be stored in summaries_index. In this case, configured the accelerated data model for 3 months but the storage that was allocated for the summaries_indes was 51 Gb only which couldn't store all the data, so the data were getting suppressed.

Increase the storage for summaries_index to 100 Gb and now the data was visible for around 40 days, so increase summaries_index as per what is needed to resolve the issue.

 

Related Links

Reference doc: 
Acceleratedatamodels