Reporting

What is the best practice to change the definition of a datamodel

marcokrueger
Path Finder

hi,
I have a heavy datamodel which is used by several dashboards. The acceleration takes more than one hour so when I change the definition of the model, the dashboards are not usable for at least one hour.
What is the best way to manage such a case without any model downtime ?

Like a pre-acceleration of the new model and than switching the two models, the old and the new one?

best regards Marco

0 Karma
1 Solution

rsennett_splunk
Splunk Employee
Splunk Employee

I think you're half way there. In order to enact this plan with near-zero downtime, you'd need to build a macro for that datamodel name so that all the dashboards use something like `beefy_DM_all_users` who's value holds the name of your datamodel. That way, if you clone the datamodel (or import it ) and make your change, then accelerate... once it's ready to go, you just change the value of the macro to point to your new datamodel ie, beefyDMallUsers16 and all the dashboards now point to the new one.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

rsennett_splunk
Splunk Employee
Splunk Employee

I think you're half way there. In order to enact this plan with near-zero downtime, you'd need to build a macro for that datamodel name so that all the dashboards use something like `beefy_DM_all_users` who's value holds the name of your datamodel. That way, if you clone the datamodel (or import it ) and make your change, then accelerate... once it's ready to go, you just change the value of the macro to point to your new datamodel ie, beefyDMallUsers16 and all the dashboards now point to the new one.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

marcokrueger
Path Finder

Thank you for the input. 🙂 What can I do for Users using pivot and saved dashboards via the webapp so dont use macros?

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

Pivot is going to be a puzzle...
Because it starts with the datamodel and then it's attached to it.
Now you can either enact or instruct people that they must replace the datamodel name (in the search string) with your macro but that'll happen over and over. (dashboard, edit panels, click the pivot icon, edit search string.
(this is just text in the dashboard... so theoretically, you could run a clean up script to overwrite the name of the dashboard with the macro...

but that might be overkill

So I think you might have to consider that any changes would have to happen off hours... and you might just be stuck with the one datamodel being edited and accelerated. 😕

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...