Splunk Enterprise Security

CIM on two separate search heads

andreibanaru
Explorer

We have two search heads:
- First is used with Enterprise Security with CIM installed and acceleration enabled on some datamodels
- On the second one(no enterprise security) we also have installed CIM, but manually, and haven't enabled acceleration on any datamodel

What would be the impact of having different acceleration settings enabled for each search head?

0 Karma

mydog8it
Builder

In our environment we run a 5 node cluster as one search head, a few single instance search heads and one ES, one ITSI heads. Acceleration is on ES and ITSI but not the others. There is no impact to the other search heads, but the accelerated data is only available on the head it is accelerated from,
I am a SplunkCloud customer, so they are very involved with the 'architecture' of our environment. Having the data accelerated where it is to be used aligns with their best practices.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...