topic Re: Error Message; The search for datamodel 'abc_123' failed to parse, cannot get indexes to search? in Getting Data In

Error Message; The search for datamodel 'abc_123' failed to parse, cannot get indexes to search?

mcrawford44 — Wed, 10 Dec 2014 16:19:02 GMT

I have two indexers in peer that share 1 index, and 1 data model. Both indexers are configured identically. Both data models are accelerated, and responsive to the '| datamodel' command.

When running a dashboard on our search head that uses the data model, we get the following message;

[indexer_2] The search for datamodel 'abc_123' failed to parse, cannot get indexes to search

When searching normally across peers, there are no errors and both indexers are responsive. When acceleration is disabled, there are no errors. However I would like to keep this feature.

Re: Error Message; The search for datamodel 'abc_123' failed to parse, cannot get indexes to search?

dmaislin_splunk — Mon, 09 Feb 2015 18:05:15 GMT

Remove any macro definitions from your data models and expand them. It will work fine after that.

Re: Error Message; The search for datamodel 'abc_123' failed to parse, cannot get indexes to search?

balaji_venkat — Wed, 25 Mar 2015 05:44:56 GMT

I had the same problem, please verify everything from the root search to the constraint by disabling acceleration and doing a preview or copy paste your search in the search bar. There could be some issue in your search, in my case there was an unbalanced ) which was the issue.

Re: Error Message; The search for datamodel 'abc_123' failed to parse, cannot get indexes to search?

jordanperks — Mon, 11 May 2015 20:47:30 GMT

I fixed this issue on the Malware Datamodel that ships with CIM app by disabling or editing any eventtype tag search that used a macro and tags malware/attack.

Re: Error Message; The search for datamodel 'abc_123' failed to parse, cannot get indexes to search?

dmaislin_splunk — Mon, 11 May 2015 20:51:51 GMT

That is what I said above. No need to disable anything though, just expand any macros in the data models.

Re: Error Message; The search for datamodel 'abc_123' failed to parse, cannot get indexes to search?

jordanperks — Mon, 11 May 2015 21:06:27 GMT

I didn't read eventtype tags from another application as "in the data model". I read it more as macros in the search that populates the data model. Just added some clarification.

Re: Error Message; The search for datamodel 'abc_123' failed to parse, cannot get indexes to search?

kamal_jagga — Tue, 07 Jul 2015 00:18:25 GMT

Hey...Would you be able to explain your statement in bit detail.

i am unaware of what is macro def in datamodel.

Thanks

Re: Error Message; The search for datamodel 'abc_123' failed to parse, cannot get indexes to search?

woodcock — Tue, 29 Aug 2017 13:20:52 GMT

This is due to a bug that caused eventtypes to no longer be able to use macros. This bug is showing fixed in 6.5.3 for SPL-130614 and SPL-135384 but we can find no releases that show that either SPL-135385 or SPL-135387 are fixed anywhere so if this matters to you, then dogpile onto these JIRAs.

Re: Error Message; The search for datamodel 'abc_123' failed to parse, cannot get indexes to search?

reed_kelly — Mon, 02 Apr 2018 20:36:39 GMT

My situation was a missing lookup file. After disabling acceleration, selecting Pivot revealed the source of the error.

Re: Error Message; The search for datamodel 'abc_123' failed to parse, cannot get indexes to search?

patng_nw — Fri, 25 May 2018 05:22:57 GMT

@dmaislin, I am hitting the same problem but my search didn't use any macro. What could be other causes?

Re: Error Message; The search for datamodel 'abc_123' failed to parse, cannot get indexes to search?

tomasmoser — Thu, 09 Apr 2020 19:13:56 GMT

Just hit the same issue with Varonis at a custer 🙂

Re: Error Message; The search for datamodel 'abc_123' failed to parse, cannot get indexes to search?

landen99 — Thu, 16 Apr 2020 22:49:24 GMT

Look at the DM constraints. DMs are picky about the format of the constraints. If there is a macro, it may be hiding a problematic constraint. For instance, you cannot include a subsearch to return a filter.