Validating ES Data

Question 1

After data is ingested, which data management step is essential to ensure raw data can be accelerated by a Data Model and used by ES?

Answer 1

Normalization to the Splunk Common Information Model

Question 2

What does ES depend on?

Answer 2

Data Models.
- DM Acceleration provides a speed up factor.
- Use searches with | tstats summariesonly=true to search accelerated data
- ES leverages the data models of the CIM to normalize data to match a common standard.