Knowledge Management

Datamodel Acceleration questions

dsofoulis
Path Finder

Hi Everyone,

I have a few questions which I haven't been able to find answers too.

I have more than one search head cluster searching across the same indexer cluster. I would like to use the SA_CIM's accelerated datamodels on all my search head clusters so that I can use TSTATS commands and have wicked fast searches + all the benefits of apps which use the CIM datamodel. From what I can tell is I'll have to have the SA_CIM app with accelerated datamodels running on each of the search head clusters, and each search head cluster will be generating its own copy of accelerated data on the indexer cluster. I would like to avoid the extra storage consumption and the extra load on the indexers for generating the accelerated data.

Is there a way that I can reuse the one copy of accelerated datamodel data for all of the search head clusters?
Or is there a better way to do what I'm trying to do?

0 Karma
1 Solution

mayurr98
SplunkTrust
SplunkTrust

Hi

I do not think there is any other way to do this as of now.
According to docs,
Summaries are restricted to a particular search head (or search head pool ID) to account for different extractions that may produce different results for the same search string.
Refer this doc:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/Acceleratedatamodels

Also, there are couple of accepted answers which says the same:
https://answers.splunk.com/answers/371944/how-to-access-an-accelerated-data-model-on-search.html
https://answers.splunk.com/answers/544456/is-there-a-way-to-share-a-data-model-across-2-sear.html

let me know if this helps!

View solution in original post

0 Karma

mayurr98
SplunkTrust
SplunkTrust

Hi

I do not think there is any other way to do this as of now.
According to docs,
Summaries are restricted to a particular search head (or search head pool ID) to account for different extractions that may produce different results for the same search string.
Refer this doc:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/Acceleratedatamodels

Also, there are couple of accepted answers which says the same:
https://answers.splunk.com/answers/371944/how-to-access-an-accelerated-data-model-on-search.html
https://answers.splunk.com/answers/544456/is-there-a-way-to-share-a-data-model-across-2-sear.html

let me know if this helps!

View solution in original post

0 Karma

dsofoulis
Path Finder

It's not the answer I was hoping for, but thank you for clarifying this.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!