Splunk Enterprise Security

How to set up shared datamodels

wgawhh5hbnht
Communicator

We have a SHC of three members & 1 Enterprise Security. Prior to 8.0 each were running their own datamodels. Now that shared datamodel summaries is possible, I would like to set this up to reduce performance and disk usage but have questions about the exact implementation as the documentation is vague:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Sharedatamodelsummaries

I know that in datamodels.conf I need to set acceleration.source_guid but that's it.
My questions are:

  1. Do I set this on the ES?
  2. Do I use /opt/splunk/etc/system/local/datamodels.conf?
  3. What would be the best way to verify the datamodels have been consolidated down to 1 copy? (right now datamodels are an exact copy of eachother)
Labels (1)
1 Solution

wgawhh5hbnht
Communicator

Answering my own question after opening a case w/ support. To accomplish this you need to:

1) Yes, set the acceleration.source_guid on ES per data model you want to accelerate. Don't do this in the [default] as there will be data models specific to only ES.

2) For me, these changes reside in "splunk/etc/apps/Splunk_SA_CIM/default/datamodels.conf" because the deployer is pushing them out to the cluster.

3) Didn't get an answer to this one.

 

Additionally, if you add additional fields in the SHC, they won't show up in the ES data models because the data model json doesn't update. On one of the SHC you will need to manually copy .json datamodel file you made a change to (/opt/splunk/etc/apps/Splunk_SA_CIM/local/data/model/) and move that over to ES. You can't use the deployer for this natively as the deployer doesn't update the .json files. If you wanted to a custom app would.

View solution in original post

0 Karma

wgawhh5hbnht
Communicator

Answering my own question after opening a case w/ support. To accomplish this you need to:

1) Yes, set the acceleration.source_guid on ES per data model you want to accelerate. Don't do this in the [default] as there will be data models specific to only ES.

2) For me, these changes reside in "splunk/etc/apps/Splunk_SA_CIM/default/datamodels.conf" because the deployer is pushing them out to the cluster.

3) Didn't get an answer to this one.

 

Additionally, if you add additional fields in the SHC, they won't show up in the ES data models because the data model json doesn't update. On one of the SHC you will need to manually copy .json datamodel file you made a change to (/opt/splunk/etc/apps/Splunk_SA_CIM/local/data/model/) and move that over to ES. You can't use the deployer for this natively as the deployer doesn't update the .json files. If you wanted to a custom app would.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...