Splunk Enterprise Security

CIM on two separate search heads

andreibanaru
Explorer

We have two search heads:
- First is used with Enterprise Security with CIM installed and acceleration enabled on some datamodels
- On the second one(no enterprise security) we also have installed CIM, but manually, and haven't enabled acceleration on any datamodel

What would be the impact of having different acceleration settings enabled for each search head?

0 Karma

mydog8it
Builder

In our environment we run a 5 node cluster as one search head, a few single instance search heads and one ES, one ITSI heads. Acceleration is on ES and ITSI but not the others. There is no impact to the other search heads, but the accelerated data is only available on the head it is accelerated from,
I am a SplunkCloud customer, so they are very involved with the 'architecture' of our environment. Having the data accelerated where it is to be used aligns with their best practices.

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...