In a multisite cluster, how do we make updated accelerated data models available in both sites with no lag?

[splunk24]

In our multisite cluster, we have two sites: site1 and site 2
We are using data model acceleration and are facing issues in getting updated accelerated data models available in both sites. There is a big lag in updating the data model in both sites.
please help

[mahamed_splunk]

What is the lag you've noticed in your env ? And forwarders send the data to both the sites or to one site only ?

[mahamed_splunk]

Per current design, the data models are independently accelerated in each site rather than replicated. So you will notice some lags initially but the system will catch up. We've enhancement requests filed to replicate the data models between sites rather building again.

[splunk24]

any update on the enhancement requests?

[splunk24]

thanks for the quick responses mahamed..
could you please elaborate enhancement request in details.. how it can be done

[splunk24]

so you filed the request with splunk to solve this issue?

[splunk24]

Hi.. No issue is not with the data coming from forwarders but data model gets accelerated after 5 min and its summary data get stored in parallel to primary bucket in one site .. So when again in next five min data model will accelerate in other site ... How can we ensure that data model accelerated data is same in both site .. And in the next five min at which site data model will accelerated and other site should be in sync

[splunk24]

please help