Reporting

What is the best practice to change the definition of a datamodel

marcokrueger
Path Finder

hi,
I have a heavy datamodel which is used by several dashboards. The acceleration takes more than one hour so when I change the definition of the model, the dashboards are not usable for at least one hour.
What is the best way to manage such a case without any model downtime ?

Like a pre-acceleration of the new model and than switching the two models, the old and the new one?

best regards Marco

0 Karma
1 Solution

rsennett_splunk
Splunk Employee
Splunk Employee

I think you're half way there. In order to enact this plan with near-zero downtime, you'd need to build a macro for that datamodel name so that all the dashboards use something like `beefy_DM_all_users` who's value holds the name of your datamodel. That way, if you clone the datamodel (or import it ) and make your change, then accelerate... once it's ready to go, you just change the value of the macro to point to your new datamodel ie, beefyDMallUsers16 and all the dashboards now point to the new one.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

rsennett_splunk
Splunk Employee
Splunk Employee

I think you're half way there. In order to enact this plan with near-zero downtime, you'd need to build a macro for that datamodel name so that all the dashboards use something like `beefy_DM_all_users` who's value holds the name of your datamodel. That way, if you clone the datamodel (or import it ) and make your change, then accelerate... once it's ready to go, you just change the value of the macro to point to your new datamodel ie, beefyDMallUsers16 and all the dashboards now point to the new one.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

marcokrueger
Path Finder

Thank you for the input. 🙂 What can I do for Users using pivot and saved dashboards via the webapp so dont use macros?

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

Pivot is going to be a puzzle...
Because it starts with the datamodel and then it's attached to it.
Now you can either enact or instruct people that they must replace the datamodel name (in the search string) with your macro but that'll happen over and over. (dashboard, edit panels, click the pivot icon, edit search string.
(this is just text in the dashboard... so theoretically, you could run a clean up script to overwrite the name of the dashboard with the macro...

but that might be overkill

So I think you might have to consider that any changes would have to happen off hours... and you might just be stuck with the one datamodel being edited and accelerated. 😕

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...