topic Re: What do we mean by multiple root event search in Data Model Acceleration? in Knowledge Management

What do we mean by multiple root event search in Data Model Acceleration?

inderjot_rasila — Tue, 29 Aug 2017 23:56:04 GMT

Hello to all the Splunkers!

I have an very important question which needs to be addressed before we do an uplift of our Splunk version.

We are planning to uplift our Splunk version from 6.3.2 to 6.6.2 or 6.6.3

We are using data model acceleration in our current Splunk version i.e. 6.3.2

As Splunk 6.6.3 is very new release (21 August 17) so mind says we should go with 6.6.2

Her comes the bone of contention I see following in 6.6.3 release notes:

Date resolved Issue number Description
2017-07-25 SPL-142801, SPL-142771 Only one root event search in a DM gets accelerated

I have no idea what is meant by this above Issue and this is making me wonder which Splunk version I should go for.

As far as my limited knowledge with Splunk I knew that we can have only one root event per data model and that is the way our current Data Model are designed.

Please help me clear my understanding and let us decide which Splunk version shall we go for.

Thanks in advance!

Regards,
Inderjot Singh Rasila

Re: What do we mean by multiple root event search in Data Model Acceleration?

jkat54 — Wed, 30 Aug 2017 01:44:24 GMT

If this is the case then you have nothing to worry about as it relates to your datamodels:

"As far as my limited knowledge with Splunk I knew that we can have only one root event per data model and that is the way our current Data Model are designed."

Just make sure you follow the clustered indexer upgrade instructions if you're in a clustered environment: http://docs.splunk.com/Documentation/Splunk/6.6.3/Indexer/Upgradeacluster

Re: What do we mean by multiple root event search in Data Model Acceleration?

inderjot_rasila — Thu, 31 Aug 2017 04:43:47 GMT

Thanks @jkat. Currently we do not have index clustering enabled

Re: What do we mean by multiple root event search in Data Model Acceleration?

jkat54 — Thu, 31 Aug 2017 07:17:20 GMT

even easier. Just upgrade to the latest version that you want then. I see no problem with 6.6.3 either.