Data Model Acceleration not Working as Expected.

Applicability

Description

Investigation

Data model starts viewing the events from the period of time it was created until the moment it was set to stop in example 30 days.

Checking the documentation:
Advanced Configuration for Persistently Accelerated Data Models

The acceleration.backfill_time parameter creates a second "backfill time range" that you set within the summary range. Splunk software builds a partial summary that initially only covers this shorter time range. After that, the summary expands with each new event summarized until it reaches the limit of the larger summary time range. At that point the full summary is complete and events that age out of the summary range are no longer retained.

For example, let's say you want to set your Summary Range to 1 Month but you know that your system would be taxed by a search that built a summary for that time range.

To deal with this, you set acceleration.backfill_time = -7d to run a search that creates a partial summary that initially just covers the past week. After that limit is reached, Splunk software would only add new events to the summary, causing the range of time covered by the summary to expand. But the full summary would still only retain events for one month, so once the partial summary expands to the full Summary Range of the past month, it starts dropping its oldest events, just like an ordinary data model acceleration summary does.
 

Resolution

The resolution for these issues is to set the backfill to a time lower that the time set for the summary range in example if the summary range is for 3 months then the backfill should be set to 1 month.