What do we mean by multiple root event search in Data Model Acceleration?

[inderjot_rasila]

Hello to all the Splunkers!

I have an very important question which needs to be addressed before we do an uplift of our Splunk version.

We are planning to uplift our Splunk version from 6.3.2 to 6.6.2 or 6.6.3

We are using data model acceleration in our current Splunk version i.e. 6.3.2

As Splunk 6.6.3 is very new release (21 August 17) so mind says we should go with 6.6.2

Her comes the bone of contention I see following in 6.6.3 release notes:

Date resolved Issue number Description
2017-07-25 SPL-142801, SPL-142771 Only one root event search in a DM gets accelerated

I have no idea what is meant by this above Issue and this is making me wonder which Splunk version I should go for.

As far as my limited knowledge with Splunk I knew that we can have only one root event per data model and that is the way our current Data Model are designed.

Please help me clear my understanding and let us decide which Splunk version shall we go for.

Thanks in advance!

Regards,
Inderjot Singh Rasila

[jkat54]

If this is the case then you have nothing to worry about as it relates to your datamodels:

"As far as my limited knowledge with Splunk I knew that we can have only one root event per data model and that is the way our current Data Model are designed."

Just make sure you follow the clustered indexer upgrade instructions if you're in a clustered environment: http://docs.splunk.com/Documentation/Splunk/6.6.3/Indexer/Upgradeacluster

[inderjot_rasila]

Thanks @jkat. Currently we do not have index clustering enabled

[jkat54]

even easier. Just upgrade to the latest version that you want then. I see no problem with 6.6.3 either.