Getting Data In

Distributed Search Environment: Do accelerated data models reside on the indexer or search head?

helge
Builder

I have an app with an accelerated data model. The data model is defined in a JSON file while the acceleration is enabled in datamodels.conf.

Splunk's documentation explains that a persistently accelerated data model resides on the indexers, but it does not tell where to put which files in a distributed environment. My understanding is that, since the TSIDX files live on the indexers, both the data model's JSON file and datamodels.conf must be on the indexers, too.

That leads to my question: do the search heads need a copy of the data model JSON file, too? Or is it sufficient to have everything related to data models on the indexers?

1 Solution

helge
Builder

Splunk really needs to improve the documentation of which files to put where regarding apps in a distributed environment. I found the answer by searching this site and verified it in our lab.

A data model is defined on the search heads, not the indexers. The following files make up the data model definition and need to be part of the app that resides on the search heads:

  • datamodels.conf
  • data_model_name.json

View solution in original post

helge
Builder

Splunk really needs to improve the documentation of which files to put where regarding apps in a distributed environment. I found the answer by searching this site and verified it in our lab.

A data model is defined on the search heads, not the indexers. The following files make up the data model definition and need to be part of the app that resides on the search heads:

  • datamodels.conf
  • data_model_name.json

cphair
Builder

Just to double-check, the files don't need to appear on the indexers at all? Does it hurt anything if they're there (i.e. cause extra load)?

0 Karma

helge
Builder

Correct, the files do not need to be placed on the indexers at all. They are automatically transferred there from the search head(s).
It might hurt having the data model definition files on the indexers, too, as it might lead to a second high performance analytics store (HPAS) being created on the indexers. See this blog article for details.

0 Karma

cphair
Builder

Thanks, this is helpful.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...