https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-it-advisable-to-implement-Splunk-ES-using-SmartStore-in-a-2/m-p/486904#M8050 <P>According to <A href="https://docs.splunk.com/Documentation/Splunk/8.0.3/Indexer/AboutSmartStore#Current_restrictions_on_SmartStore_use" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.0.3/Indexer/AboutSmartStore#Current_restrictions_on_SmartStore_use</A> </P> <P>"For multisite clusters, if any SmartStore indexes use report acceleration or data model acceleration, you must disable search affinity by setting all search heads to <CODE>site0</CODE>."</P> <P>Since Splunk Enterprise Security uses data model acceleration, would I be ill-advised to implement ES on SmartStore in a 2-site configuration? I'm concerned about performance.</P> <P>Help with this will be much appreciated!</P> Wed, 30 Sep 2020 05:13:10 GMT elliottj1 2020-09-30T05:13:10Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-it-advisable-to-implement-Splunk-ES-using-SmartStore-in-a-2/m-p/486904#M8050 <P>According to <A href="https://docs.splunk.com/Documentation/Splunk/8.0.3/Indexer/AboutSmartStore#Current_restrictions_on_SmartStore_use" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.0.3/Indexer/AboutSmartStore#Current_restrictions_on_SmartStore_use</A> </P> <P>"For multisite clusters, if any SmartStore indexes use report acceleration or data model acceleration, you must disable search affinity by setting all search heads to <CODE>site0</CODE>."</P> <P>Since Splunk Enterprise Security uses data model acceleration, would I be ill-advised to implement ES on SmartStore in a 2-site configuration? I'm concerned about performance.</P> <P>Help with this will be much appreciated!</P> Wed, 30 Sep 2020 05:13:10 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Is-it-advisable-to-implement-Splunk-ES-using-SmartStore-in-a-2/m-p/486904#M8050 elliottj1 2020-09-30T05:13:10Z