Configure data models

Version 2.1.0 of the Splunk App for NetApp Data ONTAP replaces the use of tsidx namespacing with the use of data models and data model acceleration. Existing tsidx files will be not be deleted after the upgrade, and will continue to work after the upgrade to version 2.1.0 of the Splunk App for NetApp Data ONTAP once data model acceleration is configured (see below).

See About data models to learn more.

Tsidx scheduling and storage was done on the search head. Data model acceleration is distributed across your indexers. Spreading this task across your indexers instead of your search head leads to faster searches across your installation.

Data model acceleration speeds up reporting for the entire set of attributes (fields) that you define in a data model. Data model acceleration creates summaries for the specific set of fields you and your Pivot users want to report on, accelerating the dataset represented by that collection of fields rather than a particular search against that dataset. Data that has not been accelerated yet (for example, live streaming data) will still be captured in queries by falling back to normal search for that data. Splunk Enterprise always process all summaries first, so accelerated data arrives faster. It may take a few hours to create the data model acceleration depending on the amount of data that is historically indexed.

Index storage size on your NetApp indexes will remain unchanged with the implementation of data model acceleration. Data model acceleration has a 30 day retention policy, and does not have a set size retention policy. With the upgrade to 2.1, data model acceleration summaries can, by default, take up an unlimited amount of disk space.

Click here to learn more about how to configure index size.

Your deployment's Data Model properties are located in datamodels.conf on your indexers. See "Data collection configuration file reference" to see the datamodels.conf default configuration.

Data that has not been accelerated yet (for example, live streaming data) will still be captured in queries by falling back to normal search for that data. Splunk Enterprise always process all summaries first, so accelerated data arrives faster.

See Accelerate data models to learn more.

To map tsidx namespaces to data model nodes, click here to learn more.