Hey Experts!
We have a debate going on about when splunk punches in the field values when the data model acceleration is enabled. 2 ideas,
- The accelerated field values gets processed (put into tsidx) when the data gets indexed into an index.
- The accelerated field values gets processed (put into tsidx) when a user accesses a data model. Once the data model in accessed the processed values remains for the other users.
Which one is right? Also lookup, geo tag, regex attributes also gets put into accelerated tsidx?
Cheer~! Thanks for sharing your knowledge with people in need~!