Datamodel Acceleration questions

[dsofoulis]

Hi Everyone,

I have a few questions which I haven't been able to find answers too.

I have more than one search head cluster searching across the same indexer cluster. I would like to use the SA_CIM's accelerated datamodels on all my search head clusters so that I can use TSTATS commands and have wicked fast searches + all the benefits of apps which use the CIM datamodel. From what I can tell is I'll have to have the SA_CIM app with accelerated datamodels running on each of the search head clusters, and each search head cluster will be generating its own copy of accelerated data on the indexer cluster. I would like to avoid the extra storage consumption and the extra load on the indexers for generating the accelerated data.

Is there a way that I can reuse the one copy of accelerated datamodel data for all of the search head clusters?
Or is there a better way to do what I'm trying to do?

[mayurr98 · Accepted solution]

Hi

I do not think there is any other way to do this as of now.
According to docs,
Summaries are restricted to a particular search head (or search head pool ID) to account for different extractions that may produce different results for the same search string.
Refer this doc:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/Acceleratedatamodels

Also, there are couple of accepted answers which says the same:
https://answers.splunk.com/answers/371944/how-to-access-an-accelerated-data-model-on-search.html
https://answers.splunk.com/answers/544456/is-there-a-way-to-share-a-data-model-across-2-sear.html

let me know if this helps!

[dsofoulis]

It's not the answer I was hoping for, but thank you for clarifying this.