Hey @n0psl1de , I ended up running some experiments and formulating my own answers. How did you migrate accelerated data models from the standalone SH to the cluster? So with Splunk 8, you can share DMA. I started down this route but abandoned. I was able to create new accelerations with the SH cluster while still accelerating data models with the stand alone search head. There is documentation on DMA - https://docs.splunk.com/Documentation/Splunk/8.1.1/Knowledge/Sharedatamodelsummaries What was your process to your cutover from the standalone SH to the cluster? To complete cut over, I disabled writing to apps on the standalone to prevent users from making changes. Copied over all of the apps minus Splunk default apps. Copied over the KV store. Had users verify. That's mainly it.
... View more
