Knowledge Management
Highlighted

Datamodel Acceleration questions

Path Finder

Hi Everyone,

I have a few questions which I haven't been able to find answers too.

I have more than one search head cluster searching across the same indexer cluster. I would like to use the SACIM's accelerated datamodels on all my search head clusters so that I can use TSTATS commands and have wicked fast searches + all the benefits of apps which use the CIM datamodel. From what I can tell is I'll have to have the SACIM app with accelerated datamodels running on each of the search head clusters, and each search head cluster will be generating its own copy of accelerated data on the indexer cluster. I would like to avoid the extra storage consumption and the extra load on the indexers for generating the accelerated data.

Is there a way that I can reuse the one copy of accelerated datamodel data for all of the search head clusters?
Or is there a better way to do what I'm trying to do?

0 Karma
Highlighted

Re: Datamodel Acceleration questions

SplunkTrust
SplunkTrust

Hi

I do not think there is any other way to do this as of now.
According to docs,
Summaries are restricted to a particular search head (or search head pool ID) to account for different extractions that may produce different results for the same search string.
Refer this doc:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/Acceleratedatamodels

Also, there are couple of accepted answers which says the same:
https://answers.splunk.com/answers/371944/how-to-access-an-accelerated-data-model-on-search.html
https://answers.splunk.com/answers/544456/is-there-a-way-to-share-a-data-model-across-2-sear.html

let me know if this helps!

View solution in original post

0 Karma
Highlighted

Re: Datamodel Acceleration questions

Path Finder

It's not the answer I was hoping for, but thank you for clarifying this.

0 Karma