Knowledge Management

Datamodel Acceleration questions

dsofoulis
Path Finder

Hi Everyone,

I have a few questions which I haven't been able to find answers too.

I have more than one search head cluster searching across the same indexer cluster. I would like to use the SA_CIM's accelerated datamodels on all my search head clusters so that I can use TSTATS commands and have wicked fast searches + all the benefits of apps which use the CIM datamodel. From what I can tell is I'll have to have the SA_CIM app with accelerated datamodels running on each of the search head clusters, and each search head cluster will be generating its own copy of accelerated data on the indexer cluster. I would like to avoid the extra storage consumption and the extra load on the indexers for generating the accelerated data.

Is there a way that I can reuse the one copy of accelerated datamodel data for all of the search head clusters?
Or is there a better way to do what I'm trying to do?

0 Karma
1 Solution

mayurr98
Super Champion

Hi

I do not think there is any other way to do this as of now.
According to docs,
Summaries are restricted to a particular search head (or search head pool ID) to account for different extractions that may produce different results for the same search string.
Refer this doc:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/Acceleratedatamodels

Also, there are couple of accepted answers which says the same:
https://answers.splunk.com/answers/371944/how-to-access-an-accelerated-data-model-on-search.html
https://answers.splunk.com/answers/544456/is-there-a-way-to-share-a-data-model-across-2-sear.html

let me know if this helps!

View solution in original post

mayurr98
Super Champion

Hi

I do not think there is any other way to do this as of now.
According to docs,
Summaries are restricted to a particular search head (or search head pool ID) to account for different extractions that may produce different results for the same search string.
Refer this doc:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/Acceleratedatamodels

Also, there are couple of accepted answers which says the same:
https://answers.splunk.com/answers/371944/how-to-access-an-accelerated-data-model-on-search.html
https://answers.splunk.com/answers/544456/is-there-a-way-to-share-a-data-model-across-2-sear.html

let me know if this helps!

dsofoulis
Path Finder

It's not the answer I was hoping for, but thank you for clarifying this.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...