Deployment Architecture

In a multisite cluster, how do we make updated accelerated data models available in both sites with no lag?

splunk24
Path Finder

In our multisite cluster, we have two sites: site1 and site 2
We are using data model acceleration and are facing issues in getting updated accelerated data models available in both sites. There is a big lag in updating the data model in both sites.
please help

0 Karma

mahamed_splunk
Splunk Employee
Splunk Employee

What is the lag you've noticed in your env ? And forwarders send the data to both the sites or to one site only ?

0 Karma

mahamed_splunk
Splunk Employee
Splunk Employee

Per current design, the data models are independently accelerated in each site rather than replicated. So you will notice some lags initially but the system will catch up. We've enhancement requests filed to replicate the data models between sites rather building again.

splunk24
Path Finder

any update on the enhancement requests?

0 Karma

splunk24
Path Finder

thanks for the quick responses mahamed..
could you please elaborate enhancement request in details.. how it can be done

0 Karma

splunk24
Path Finder

so you filed the request with splunk to solve this issue?

0 Karma

splunk24
Path Finder

Hi.. No issue is not with the data coming from forwarders but data model gets accelerated after 5 min and its summary data get stored in parallel to primary bucket in one site .. So when again in next five min data model will accelerate in other site ... How can we ensure that data model accelerated data is same in both site .. And in the next five min at which site data model will accelerated and other site should be in sync

0 Karma

splunk24
Path Finder

please help

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...