Enterprise Security Question

[pfabrizi]

We are using ES and I was wondering if all the data models\lookups and enriched data available when searching from a non ES search head?

our deployment has a ES search head and then 2 clustered search heads.

I have an alert that uses a value populated by ES which in our DEV space works great but this is a single search head with ES.

I just had a thought yesterday at everything we doing for our Prod space will on be available if those alerts are run from our ES search head and that clustered search head would not be able to use those?

Thanks!

[starcher · Accepted solution]

No. Accelerated datamodels are tied to the search head guid that generated them. Lookups and other knowledge object exist only in the searchhead where created unless you create way to sync them over.