Also, what actually does Splunk do when we give the below line in datamodels.conf file?
acceleration.max_concurrent = 1
could someone provide me a basic level understanding of datamodels.conf?
Hi at all, my customer has the requirement to have the "index" field in each DataModel used in ES. Obviously, this additional field doesn't modify CIM compliance but it's needed to make an addition...
...his DM in all 3 Search Head members and Macro too will be updated in all 3 SH members ?
Question 2 - or should i make above changes in "Splunk_SA_CIM" app under "local" folder in macros.conf and datamodels...
...now that in datamodels.conf I need to set acceleration.source_guid but that's it. My questions are:
Do I set this on the ES?
Do I use /opt/splunk/etc/system/local/datamodels.conf?
What w...
I installed the Fortinet FortiGate App 1.5.1 for Splunk as well as the Fortinet FortiGate Add-On 1.6.2 for Splunk and configured the sourcetype in the props.conf file.
After that I restarted t...
I've been playing around with the new datasets add-on - it's very slick, well done. Now I want to delete some of the testing tables I created, but there isn't a Delete option in the Data Model Manage...
Hello,
I have a question about modification of data model in CIM:
I would like to add one child dataset to DM "Change". Can I do it by separate application?
What I mean exactly: If I create a m...
...xample, I disable acceleration on all of the data models in the app through the UI, then check the local datamodels.conf file and everything's fine except that I still see those datamodel a...
Hello,
We are going to setup some reports to use acceleration using Summary Range of 7 days. Question, how often will Splunk behinds the scene keep the data in the 7 days range. Does Splunk accele...
We have 2 separate search clusters fed by the same index cluster.
The reason to have two search clusters was to host 2 sets of apps/add-ons that serve 2 different functional groups.
Now we are...