Knowledge Management

Datamodel Acceleration questions

dsofoulis
Path Finder

Hi Everyone,

I have a few questions which I haven't been able to find answers too.

I have more than one search head cluster searching across the same indexer cluster. I would like to use the SA_CIM's accelerated datamodels on all my search head clusters so that I can use TSTATS commands and have wicked fast searches + all the benefits of apps which use the CIM datamodel. From what I can tell is I'll have to have the SA_CIM app with accelerated datamodels running on each of the search head clusters, and each search head cluster will be generating its own copy of accelerated data on the indexer cluster. I would like to avoid the extra storage consumption and the extra load on the indexers for generating the accelerated data.

Is there a way that I can reuse the one copy of accelerated datamodel data for all of the search head clusters?
Or is there a better way to do what I'm trying to do?

0 Karma
1 Solution

mayurr98
Super Champion

Hi

I do not think there is any other way to do this as of now.
According to docs,
Summaries are restricted to a particular search head (or search head pool ID) to account for different extractions that may produce different results for the same search string.
Refer this doc:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/Acceleratedatamodels

Also, there are couple of accepted answers which says the same:
https://answers.splunk.com/answers/371944/how-to-access-an-accelerated-data-model-on-search.html
https://answers.splunk.com/answers/544456/is-there-a-way-to-share-a-data-model-across-2-sear.html

let me know if this helps!

View solution in original post

mayurr98
Super Champion

Hi

I do not think there is any other way to do this as of now.
According to docs,
Summaries are restricted to a particular search head (or search head pool ID) to account for different extractions that may produce different results for the same search string.
Refer this doc:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/Acceleratedatamodels

Also, there are couple of accepted answers which says the same:
https://answers.splunk.com/answers/371944/how-to-access-an-accelerated-data-model-on-search.html
https://answers.splunk.com/answers/544456/is-there-a-way-to-share-a-data-model-across-2-sear.html

let me know if this helps!

dsofoulis
Path Finder

It's not the answer I was hoping for, but thank you for clarifying this.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...