topic Re: Datamodel replication issue in SHC in Deployment Architecture

Datamodel replication issue in SHC

Nawab — Mon, 16 Dec 2024 10:34:27 GMT

I have a SHC of 3 search heads. I changed some fields in data model of 1 sh. it is replicated on 2nd SH, but 3rd SH does not have the same fields. Even though that SH was the captian.

I ran resync command but still the same issue.

Re: Datamodel replication issue in SHC

gcusello — Mon, 16 Dec 2024 10:41:31 GMT

Hi @Nawab ,

did you configured your SHs to send logs to the Indexers?

Ciao.

Giuseppe

Re: Datamodel replication issue in SHC

Nawab — Mon, 16 Dec 2024 10:42:37 GMT

yes, sh is sending logs to indexers

Re: Datamodel replication issue in SHC

gcusello — Mon, 16 Dec 2024 10:52:14 GMT

Hi @,

please see this:

https://docs.splunk.com/Documentation/Splunk/9.3.2/Indexer/Clustersandsummaryreplication

Ciao.

Giuseppe

Re: Datamodel replication issue in SHC

Nawab — Mon, 16 Dec 2024 11:25:07 GMT

I dont think this is related to my case. if change is replicated with in 2 SH, why changes are not replicated on 1 SH, all 3 SH are sending logs to indexers

Re: Datamodel replication issue in SHC

isoutamo — Mon, 16 Dec 2024 21:43:13 GMT

Have you check that your SHC is healthy and there is no issues e.g. with kvstore or other replications? Easiest this can do with MC or if you haven’t set it up, then you can do those by queries from internal indexes, rest api and cli.

Re: Datamodel replication issue in SHC

PickleRick — Mon, 16 Dec 2024 23:21:28 GMT

Ok. Do you mean that you redefined the Datamodel itself or just changed the acceleratio parameters? And are you talking about the dataset definitions or the summarized data in context of it being not in sync?

How did you modify those configurations?

Do you have the same settings defines within an app pushed from the deployer?

Re: Datamodel replication issue in SHC

Nawab — Tue, 17 Dec 2024 07:32:09 GMT

I have just added a field in datamodel which i need to use in my searches. this field is duplicated in 2 SHs but in 1 SH that field is not available.

Cluster health is Okay, and if I change any thing on dashboards or corelation search it is reflected in all SHs

Re: Datamodel replication issue in SHC

PickleRick — Tue, 17 Dec 2024 07:50:19 GMT

OK. How did you edit the datamodel? Normally from the WebUI? Or did you fiddle with the jsons directly?

Re: Datamodel replication issue in SHC

Nawab — Tue, 17 Dec 2024 07:51:59 GMT

I edited the datamodel using web UI, also I just edited a macro and it is reflected in the cluster

Re: Datamodel replication issue in SHC

PickleRick — Tue, 17 Dec 2024 16:26:58 GMT

Ok. This might call for some more troubleshooting but what I'd check

1. Whether the contents of the etc/apps are the same on all nodes.

2. What is the status of the shcluster.

3. If it's always the same sh that is not in sync? And if it's "both ways" out of sync - changes on other shs are not replicated to this one and changes on this one are not replicated to other ones.

Check the connectivity within the cluster, check logs.