We are currently using a Splunk Enterprise environment with one search head and one indexer. We enabled data model acceleration because the performance of the search became poor as we used the system. We are planning to increase the number of search heads by one in order to accommodate more users in the future. Will the data model acceleration enabled for the first search head automatically be enabled for the next search head? I do not believe that any additional configuration is necessary, especially since the .tsdix file is configured in the indexer, not in the search head. If there are any settings required to enable data model acceleration for additional search heads, please let me know. ... View more

I try to edit lookup file through the lookup file editor, but below message is shown. The file is too big to be edited (must be less than 10 MB) Is there any workaround other than reducing the lookup file size? ... View more