topic Re: How do I use the same data model on multiple search heads? in Deployment Architecture

How do I use the same data model on multiple search heads?

secuc2r83 — Thu, 24 Jan 2019 21:16:06 GMT

Hi,

I have 2 independent Search Heads (SH) (no clustering) and they use the same indexers.

On the first SH: I have a data model, and i want users from the 2nd SH request it.

But it's impossible to share it in parameters.

Is it possible to do this? (because in my mind, a data model stores statistics in a new .tsidx on indexers available for my 2 SH)

Thanks

Re: How do I use the same data model on multiple search heads?

HiroshiSatoh — Fri, 25 Jan 2019 01:30:16 GMT

datamodels.conf needs to be placed in the search head. You need to copy .conf or set it manually.
tsidx is used when acceleration .

Re: How do I use the same data model on multiple search heads?

secuc2r83 — Fri, 25 Jan 2019 13:06:17 GMT

Hi HiroshiSatoh

It works when i do 2 things:
a) Copy datamodels.conf
b) copy "Name_DM".json

But big problem:
When i ask for accelerate data => it build another .tsidx and don't use the first's one
Then i create 2 datamodels .tsidx on indexers with same stats

Any idea ?

Re: How do I use the same data model on multiple search heads?

HiroshiSatoh — Fri, 25 Jan 2019 13:23:06 GMT

tsidx is created in the bucket of the index. It is common for each indexer to exist.

Re: How do I use the same data model on multiple search heads?

secuc2r83 — Fri, 25 Jan 2019 19:29:40 GMT

Sorry HiroshiSatoh but i don't understand:
tsidx already exists on my indexers, i just want to point my 2 datamodels on it ?
Is it possible or when accelerate a copy of a datamodels it will always create his own .tsidx ?

Regards

Re: How do I use the same data model on multiple search heads?

woodcock — Fri, 25 Jan 2019 21:16:46 GMT

You cannot share ADMs between search heads. This stinks because it requires multiple copies of the ADMs on disk (one for each Search Head) and multiple executions of the ADM searches wasting Indexer CPUs to run the same searches (actually, it is possible splunk has been enhanced so that the latter is no longer true).

Re: How do I use the same data model on multiple search heads?

secuc2r83 — Sat, 26 Jan 2019 08:52:56 GMT

Hi woodcock,
Thanks for helping

I don't understand why "technologically" i can't, because when i create a DM:

On SH1 create:  
- local/datamodels.conf
- data/model/DM_test.json
On indexer1 create:
- 1st .tsidx
- 2nd .tsidx when accelerate

If i use another Search-Head:

On SH2 create:  
- local/datamodels.conf
- data/model/DM_test.json

Then nothing to create on indexer, just point to .tsidx create by first one

I won't waste indexer CPUs because data already indexed by 1st DM. (don't want to generate again)
Just want to extract data or stats from .tsidx that already exists
Then no CPUs wasting on indexer but just on SH2 during "Search time"
Something wrong ?

Re: How do I use the same data model on multiple search heads?

chrisyounger — Sat, 26 Jan 2019 09:03:15 GMT

Becuase different search heads can have different search time extractions and other knowledge objects can be different. This affects what is in the data model and why different search heads can't share the same data models.

Re: How do I use the same data model on multiple search heads?

HiroshiSatoh — Sat, 26 Jan 2019 13:22:23 GMT

Will not you solve in this ”Knowledge Manager Manual”?

https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/Acceleratedatamodels

Re: How do I use the same data model on multiple search heads?

secuc2r83 — Wed, 13 Feb 2019 12:55:31 GMT

Hi,

I contact Splunk support:
They confirm that is not possible to share a "datamodel acceleration" if you are not on a Search Head Cluster (SHC).
Because SH not share the same knowledge objects and configurations.

Hope it helps
Regards

Re: How do I use the same data model on multiple search heads?

bandit — Mon, 17 Feb 2020 16:00:17 GMT

Shared datamodels are available as of Splunk 8x https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Sharedatamodelsummaries