The Blueprint • Room 3

Acceleration

**Data Model Acceleration (DMA)** builds summary metadata (TSIDX files) alongside your raw index buckets.

This drastically speeds up reporting because Splunk only has to read the summary files instead of parsing raw events.

Use the `tstats` command to search accelerated data models directly.

Tstats with Data Models

| tstats count FROM datamodel=Authentication WHERE nodename=Authentication.Failed_Authentication

Knowledge Check

Prove your understanding to clear the room (Rewards XP)

Write a tstats search to count events from the "Network_Traffic" datamodel.

Splunk Search Bar