I have 2 independent Search Heads (SH) (no clustering) and they use the same indexers.
On the first SH: I have a data model, and i want users from the 2nd SH request it.
But it's impossible to share it in parameters.
Is it possible to do this? (because in my mind, a data model stores statistics in a new .tsidx on indexers available for my 2 SH)
datamodels.conf needs to be placed in the search head. You need to copy .conf or set it manually.
tsidx is used when acceleration .
It works when i do 2 things:
a) Copy datamodels.conf
b) copy "Name_DM".json
But big problem:
When i ask for accelerate data => it build another .tsidx and don't use the first's one
Then i create 2 datamodels .tsidx on indexers with same stats
Any idea ?
Sorry HiroshiSatoh but i don't understand:
tsidx already exists on my indexers, i just want to point my 2 datamodels on it ?
Is it possible or when accelerate a copy of a datamodels it will always create his own .tsidx ?
You cannot share ADMs between search heads. This stinks because it requires multiple copies of the ADMs on disk (one for each Search Head) and multiple executions of the ADM searches wasting Indexer CPUs to run the same searches (actually, it is possible splunk has been enhanced so that the latter is no longer true).
Thanks for helping
I don't understand why "technologically" i can't, because when i create a DM:
On SH1 create: - local/datamodels.conf - data/model/DM_test.json On indexer1 create: - 1st .tsidx - 2nd .tsidx when accelerate
If i use another Search-Head:
On SH2 create: - local/datamodels.conf - data/model/DM_test.json
Then nothing to create on indexer, just point to .tsidx create by first one
I won't waste indexer CPUs because data already indexed by 1st DM. (don't want to generate again)
Just want to extract data or stats from .tsidx that already exists
Then no CPUs wasting on indexer but just on SH2 during "Search time"
Something wrong ?
Becuase different search heads can have different search time extractions and other knowledge objects can be different. This affects what is in the data model and why different search heads can't share the same data models.
I contact Splunk support:
They confirm that is not possible to share a "datamodel acceleration" if you are not on a Search Head Cluster (SHC).
Because SH not share the same knowledge objects and configurations.
Hope it helps