Distributed Search Environment: Do accelerated data models reside on the indexer or search head?

[helge]

I have an app with an accelerated data model. The data model is defined in a JSON file while the acceleration is enabled in datamodels.conf.

Splunk's documentation explains that a persistently accelerated data model resides on the indexers, but it does not tell where to put which files in a distributed environment. My understanding is that, since the TSIDX files live on the indexers, both the data model's JSON file and datamodels.conf must be on the indexers, too.

That leads to my question: do the search heads need a copy of the data model JSON file, too? Or is it sufficient to have everything related to data models on the indexers?

[helge · Accepted solution]

Splunk really needs to improve the documentation of which files to put where regarding apps in a distributed environment. I found the answer by searching this site and verified it in our lab.

A data model is defined on the search heads, not the indexers. The following files make up the data model definition and need to be part of the app that resides on the search heads:

• datamodels.conf
• data_model_name.json

[cphair]

Just to double-check, the files don't need to appear on the indexers at all? Does it hurt anything if they're there (i.e. cause extra load)?

[helge]

Correct, the files do not need to be placed on the indexers at all. They are automatically transferred there from the search head(s).
It might hurt having the data model definition files on the indexers, too, as it might lead to a second high performance analytics store (HPAS) being created on the indexers. See this blog article for details.

[cphair]

Thanks, this is helpful.