The tsidx namespaces generated by tscollect are ALWAYS stored on the search head that executes the tscollect search. They cannot be forwarded or replicated to the indexers. Per indexes.conf.spec you will see the location of the files called out by indexes.conf. You can make things work in search head pooled environments by making the tsidxStatsHomePath property point to some shared storage but it has a performance penalty. Without shared storage you cannot make tscollect based namespaces work in a search head pool or cluster and you will receive no scale benefit from map-reduce.
Data model acceleration works very differently and does keep the accelerated namespaces along side the originating indexes on the indexer tier.
Please see indexes.conf.spec for more details on tsidxStatsHomePath.
If namespace is provided, the tsidx files are written to a directory of that name under the main tsidxstats directory (that is, within $SPLUNK_DB/tsidxstats). These namespaces can be written to multiple times to add new data. If namespace is not provided, the files are written to a directory within the job directory of that search, and will live as long as the job does. This namespace location is also configurable in indexes.conf, with the attribute tsidxStatsHomePath.
Hi, thanks for your response.
I read the same documentation but I still can't tell where that location is and I'm unable to find it.
Is it on one of the indexers?
Is it on the search head? If so, which one? The SH that I ran tscollect?
(What if I'm logged in to SSO VIP -- I won't know which one in that case.)
If I'm using SH_POOLING, is it located somewhere else?
The documentation is too vague.