topic Re: Why are we are receiving error "-0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found" search head instances? in Deployment Architecture

Why are we are receiving error "-0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found" search head instances?

Hemnaath — Tue, 17 Jan 2017 17:07:24 GMT

Hi All,

We are getting this error in Splunk search head instances -0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found.

We are getting the above error message in splunkd.log, not sure what as went wrong really and why we are getting this error message in splunkd.log after restarting the Splunk services. Kindly guide us in fixing this issue.

0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found.
0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found.
0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found.
0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found.

thanks in advance.

Re: Why are we are receiving error "-0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found" search head instances?

Hemnaath — Mon, 06 Feb 2017 10:39:45 GMT

Hi All, Can anyone throw me some lights on this error .

thanks in advance.

Re: Why are we are receiving error "-0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found" search head instances?

sves — Mon, 07 May 2018 12:51:43 GMT

For now, all the light I can shed is that I see athe exact same error (different data model though) with one of my Splunk customers. The "-0500" in the beginning of your line is your time zone, so not really a part of the message. I will post my findings if I figure out what is going on with this error message.

Re: Why are we are receiving error "-0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found" search head instances?

sves — Mon, 07 May 2018 13:03:12 GMT

Found this here on Answers

Re: Why are we are receiving error "-0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found" search head instances?

Hemnaath — Mon, 07 May 2018 13:56:47 GMT

thanks sves for you are update.

Re: Why are we are receiving error "-0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found" search head instances?

sves — Mon, 07 May 2018 14:11:03 GMT

In the case of my customer, the data model json file was missing, and the datamodels.conf was set up with acceleration = 1. So every 5 minutes, Splunk would be complaining. Simply removing references to the missing data model is an easy fix. Or, recreate the data model from backup if one is available.

I see in other cases this has to do with permission - check out this answers article