According to https://docs.splunk.com/Documentation/Splunk/8.0.3/Indexer/AboutSmartStore#Current_restrictions_on_S...
"For multisite clusters, if any SmartStore indexes use report acceleration or data model acceleration, you must disable search affinity by setting all search heads to site0."
Since Splunk Enterprise Security uses data model acceleration, would I be ill-advised to implement ES on SmartStore in a 2-site configuration? I'm concerned about performance.
Help with this will be much appreciated!
