topic Re: Distributed Search Environment: Do accelerated data models reside on the indexer or search head? in Getting Data In

Distributed Search Environment: Do accelerated data models reside on the indexer or search head?

helge — Wed, 28 Jan 2015 16:34:22 GMT

I have an app with an accelerated data model. The data model is defined in a JSON file while the acceleration is enabled in datamodels.conf.

Splunk's documentation explains that a persistently accelerated data model resides on the indexers, but it does not tell where to put which files in a distributed environment. My understanding is that, since the TSIDX files live on the indexers, both the data model's JSON file and datamodels.conf must be on the indexers, too.

That leads to my question: do the search heads need a copy of the data model JSON file, too? Or is it sufficient to have everything related to data models on the indexers?

Re: Distributed Search Environment: Do accelerated data models reside on the indexer or search head?

helge — Tue, 29 Sep 2020 06:56:18 GMT

Splunk really needs to improve the documentation of which files to put where regarding apps in a distributed environment. I found the answer by searching this site and verified it in our lab.

A data model is defined on the search heads, not the indexers. The following files make up the data model definition and need to be part of the app that resides on the search heads:

datamodels.conf
data_model_name.json

Re: Distributed Search Environment: Do accelerated data models reside on the indexer or search head?

cphair — Tue, 05 Apr 2016 14:20:35 GMT

Just to double-check, the files don't need to appear on the indexers at all? Does it hurt anything if they're there (i.e. cause extra load)?

Re: Distributed Search Environment: Do accelerated data models reside on the indexer or search head?

helge — Tue, 05 Apr 2016 14:47:32 GMT

Correct, the files do not need to be placed on the indexers at all. They are automatically transferred there from the search head(s).
It might hurt having the data model definition files on the indexers, too, as it might lead to a second high performance analytics store (HPAS) being created on the indexers. See this blog article for details.

Re: Distributed Search Environment: Do accelerated data models reside on the indexer or search head?

cphair — Tue, 05 Apr 2016 14:49:02 GMT

Thanks, this is helpful.