Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- How to stop datamodels from rebuilding on a new Di...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
We broken up a single install [SH + Indexer].
We have created a new SH and added the original Indexer(Full of data, Indexer and Data models).
When log into new SH the data models are rebuilding. How can i stop this please?
I need to stop this as the Data model goes back 6 months and the data in the index is 1 month long, so by re-building i am loosing 5 months of Data model.
Regards
Robert
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Unfortunately, your understanding is incorrect. The ADM data is always referencing the raw data so once the raw data goes, so does the useability of the ADM. You need to retain the raw data to match your desired ADM backfill or reduce your backfill.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Unfortunately, your understanding is incorrect. The ADM data is always referencing the raw data so once the raw data goes, so does the useability of the ADM. You need to retain the raw data to match your desired ADM backfill or reduce your backfill.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
You are correct, i just did a test - thanks for this 🙂 .
But we are still having the issues where the datamodel is rebuilding on SH, this is putting the BOX to 100% for hours and we have about 20 datamodels. To me the datamodel should be need to rebuild as they where all ready built.
The difference is we have a new SH and we are getting the old INDEXER to be a node.
Thanks in Advance if you have any insights.
Rob
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
