topic datamodel in Monitoring Splunk

datamodel

vid1 — Fri, 20 Sep 2024 09:27:38 GMT

i am facing error while running datamodel below

The search job has failed due to err='Error in 'SearchParser': The search specifies a macro 'isilon_index' that cannot be found.

gcusello — Fri, 23 Aug 2024 12:34:04 GMT

usually in DataModel's there's a macro to reduce the indexes to use in the population activity.

You can check this macro in the DataModel constrains.

Now this macro isn't present in your environment or you haven't the permissions to use it.

Search for this macro:

if present check the permissions,

if not present create it or remove t from the dataModel Constrains.

Which DataModel are you speaking of?

Ciao.

Giuseppe

vid1 — Fri, 23 Aug 2024 12:36:48 GMT

Authentication datamodel
that macro is not there in my macros list

gcusello — Fri, 23 Aug 2024 12:38:58 GMT

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

vid1 — Fri, 23 Aug 2024 12:41:35 GMT

Authentication datamodel