topic Re: Datamodel issues in Knowledge Management

Datamodel issues

damode — Wed, 08 Jul 2020 10:26:58 GMT

When I pivot a particular datamodel, I get this error, "Datamodel 'Splunk_CIM_Validation.Vulnerabilities' had an invalid search, cannot get indexes to search"

After inspecting the search.log, I noticed these two error messsages.

07-08-2020 20:16:24.484 ERROR AdminManagerValidation - 'undefineduundefined' is not a time string.
07-08-2020 20:16:24.484 ERROR DataModelValidator - 'undefineduundefined' is not a time string.

Can someone please help how to fix this issue ?

Re: Datamodel issues

misterduke — Wed, 08 Jul 2020 15:13:38 GMT

Hello,

here is a similar topic. did you try those steps?

in a nutshell you should check the datamodel and the macro and look what's in it. if the datamodel uses a macro and this particular macro tries to search an index that doesn't exist, you get an error. if the SPL within the datamodel/macro lacks something, you get an error.

you can expand macros btw with STRG (or command)+Shift+E

hope that helps

Re: Datamodel issues

damode — Tue, 14 Jul 2020 02:20:44 GMT

Thanks for your help. I was able to fix the issue by disabling the datamodel acceleration which was still stuck on "building" status.