topic Re: Data Model: Change Root Event Constraint returns 0 results. in Knowledge Management

Data Model: Change Root Event Constraint returns 0 results.

Tim_1 — Thu, 28 Sep 2017 13:35:48 GMT

Hi all,

I've been working on a Data Model, and have a root event with constraint:
index=test_index

Now, when I change the constraint to:
index=prod_index

In the preview, nothing gets returned.

1) Can you change the index in the constraint?
2) Also, can you have wildcard in the constrain such as index="*_index"?

There is data in both indexes and I'm using Splunk Enterprise 6.4.2.

Thanks all.

Re: Data Model: Change Root Event Constraint returns 0 results.

andre_tucker — Sun, 01 Oct 2017 13:43:52 GMT

Are there any fields that you are specifying as "required" that are null in your prod index?

Re: Data Model: Change Root Event Constraint returns 0 results.

Tim_1 — Mon, 02 Oct 2017 09:03:06 GMT

@andre_tucker, yes there were.
Does previewing the data when changing the constraint also apply the required attributes as well then?

Re: Data Model: Change Root Event Constraint returns 0 results.

andre_tucker — Tue, 03 Oct 2017 11:35:56 GMT

Yes I believe if your constraints are required and come in as null then the preview will take this into account and not show results. Please test by changing the required field to optional. If that does not work let me know.