topic Re: Data Model in Security

Data Model

Mohamad_Alaa — Wed, 29 Nov 2023 07:38:58 GMT

is the output of the attached image right?
i can see data model per run duration but by size has no values

Re: Data Model

gcusello — Wed, 29 Nov 2023 08:07:27 GMT

Hi @Mohamad_Alaa ,

you should check if the population scheduled searches are running and if they have results.

It seems that these scheduled searches are running, but they always have empty results.

Are you using CIM>4.X compliant add-ons?

Ciao.

Giuseppe

Re: Data Model

Mohamad_Alaa — Wed, 29 Nov 2023 08:24:13 GMT

can you elaborate more regarding this point
"you should check if the population scheduled searches are running and if they have results"
How i can check it?

i installed CIM 5.2.0 and yes i installed TA-addons but not sure about compatibility, do you recommend download to 4.x?

Re: Data Model

gcusello — Wed, 29 Nov 2023 09:22:48 GMT

hi @Mohamad_Alaa ,

when you choose an add-on from splunkbase, you should check the CIM compliance level.

about population searches, you should see in each Data Model the contrains, this is the population scheduled search

you should try to run these searches and see if you have results,these results are the records in the DataModel.

Ciao.

Giuseppe

Re: Data Model

Mohamad_Alaa — Wed, 29 Nov 2023 11:03:21 GMT

when i access a data model (authentication for example)
I noticed the below shown error

"This object has no explicit index constraint. Consider adding one for better performance."

Re: Data Model

Mohamad_Alaa — Wed, 29 Nov 2023 11:48:58 GMT

at the same time i have a message

The search "Network - Traffic Volume Per 30m - Model Gen" is related to the correlation search "Network - Unusual Volume of Network Activity - Rule" but it is not enabled even though the correlation search is; this will cause the correlation to fail

Re: Data Model

Mohamad_Alaa — Wed, 29 Nov 2023 12:20:52 GMT

I added specifically the index, still having same issue
I noticed the below as well

""App configuration
The "Splunk Common Information Model" app has not been fully configured yet.This app has configuration properties that can be customized for this Splunk instance. Depending on the app, these properties may or may not be required.""

but not sure how to proceed already index was added and some data models were accelerated, i only have same button not a next or proceed button

Re: Data Model

gcusello — Wed, 29 Nov 2023 13:34:19 GMT

Hi @Mohamad_Alaa ,

as I said, you have to enable datamodels and accelerations.

Ciao.

Giuseppe

Re: Data Model

Mohamad_Alaa — Wed, 29 Nov 2023 14:13:12 GMT

problem solved, i appreciate all your responses

once i search in SH, i should use the parameter splunk_server=* in order to see results
So obviously this was my issue as i should see results without such paramter

modified the below on SH, solved it

C:\Program Files\Splunk\etc\system\local\distsearch.conf

[distributedSearch:dmc_group_indexer]

default = false

Re: Data Model

gcusello — Wed, 29 Nov 2023 14:57:36 GMT

hi @Mohamad_Alaa ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉