Deployment Architecture

In a multisite cluster, how do we make updated accelerated data models available in both sites with no lag?

splunk24
Path Finder

In our multisite cluster, we have two sites: site1 and site 2
We are using data model acceleration and are facing issues in getting updated accelerated data models available in both sites. There is a big lag in updating the data model in both sites.
please help

0 Karma

mahamed_splunk
Splunk Employee
Splunk Employee

What is the lag you've noticed in your env ? And forwarders send the data to both the sites or to one site only ?

0 Karma

mahamed_splunk
Splunk Employee
Splunk Employee

Per current design, the data models are independently accelerated in each site rather than replicated. So you will notice some lags initially but the system will catch up. We've enhancement requests filed to replicate the data models between sites rather building again.

splunk24
Path Finder

any update on the enhancement requests?

0 Karma

splunk24
Path Finder

thanks for the quick responses mahamed..
could you please elaborate enhancement request in details.. how it can be done

0 Karma

splunk24
Path Finder

so you filed the request with splunk to solve this issue?

0 Karma

splunk24
Path Finder

Hi.. No issue is not with the data coming from forwarders but data model gets accelerated after 5 min and its summary data get stored in parallel to primary bucket in one site .. So when again in next five min data model will accelerate in other site ... How can we ensure that data model accelerated data is same in both site .. And in the next five min at which site data model will accelerated and other site should be in sync

0 Karma

splunk24
Path Finder

please help

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...