All Apps and Add-ons

Anomali ThreatStream Community App: What does "Error in TsidxStats": Could not find datamodel: TS_optic" mean and how do I fix it?

New Member

I am new to the Splunk world, but I was trying to use Anomali ThreatStream Community App and a search but get the following errors:
(1) Error in "TsidxStats": Could not find datamodel: TS_Optic
(2) The search job has failed due to an error. You may be able view job in the "Job Inspector"

My question is: what is "datamodel : TS_Optic"? How do I create one?

0 Karma


Hey @pmchao -

I work @ Anomali and can help you fix this ASAP.

We've just released a new version of the app with some fixes. Although this was not a known issue can you configure the new app on your Splunk instance and report if this issue persists?

Hopefully it will be resolved, if not, please can you reply the steps you went through to configure the app (including any data you're using -- sources, sourcetypes, etc) so we can begin to troubleshoot?


0 Karma

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!