Why CIM Data Model Acceleration May Fail: Summary Range and earliest_time

Quick Answer

Data model acceleration doesn't summarize your entire dataset by default, it only builds its summary for whatever time window the acceleration configuration specifies, and searches falling outside that window have to fall back to scanning raw, unaccelerated events, which is inherently slower. Here, earliest_time is set to -7d@d, meaning the acceleration summary only covers the trailing 7 days of data; any part of a search's time range that extends beyond that, like the remaining days in a 60-day query, isn't covered by the accelerated summary at all and has to be searched the traditional way. This is a distinct setting from summary_range, which governs how long accelerated summary data is retained before being aged out, not how far back the acceleration actually extends its coverage in the first place; conflating the two is an easy mistake since both deal with time and data models. It's also worth noting that using the datamodel command isn't a prerequisite for benefiting from acceleration, since acceleration is applied transparently whenever a search leverages the data model. The general principle to carry forward is that data model acceleration only speeds up queries within its configured earliest_time window, so any exam scenario describing degraded performance for data older than a stated boundary is almost always pointing at that earliest_time setting rather than a retention or command-related setting.