All Apps and Add-ons

Data model wrangler dashboard not populating



We've setup the Data Model Wrangler App in our on-prem Search Head. We're running Splunk Core 9.0.3 and ES 7.0.1 

The latest SA-cim-validator and CIM App are installed as per the installation notes. These apps are working as expected showing results from the validator app.

I created an index from the Splunk WebUI visible under the DM Wrangler App called data_model_wrangler.

We've scheduled the 3 saved searches that come with the App as per the instructions.

We only see results out of 1 from the 3 saved searches from the DM Wrangler App.  Also the index created is empty.

This being 


 The two other saved searches are:

with errors:
No results to summary index.

All saved searches and indexes are enabled.

Can anyone please suggest where we've gone wrong in setting this up?


Thanks in advance

Labels (1)
0 Karma


Hi @slider8p2023,

did you customized the three macros that are present in this app to populate the lookups?

they are:

  • `data_model_wrangler_index`
    • Index to which summary data will be sent
    • Default: data_model_wrangler
  • `datamodel_wrangler_data_model_list`
    • Comma separated list of data models to monitor
    • Default: Authentication, Change, Change_Analysis, DLP, Databases, Email, Endpoint, Intrusion_Detection, Malware, Network_Resolution, Network_Sessions, Network_Traffic, Web
  • `data_model_wrangler_health_review_lookup`
    • The name of the lookup containing review information
    • Default: data_model_wrangler_health_review.csv

Put attention especially to the first  that contains the list of indexer to check.



0 Karma


Hi @gcusello 

I checked the macros again and they contain the same values you listed earlier.

Unless we've missed something, very basic they look in order. I've attached the screenshots of the macro configs.
I believe they are correct? They were all self populated when the App was installed. There are no details about special settings for the index which I created via the WebUI with the suggested default index name.

Thanks againdata_model_wrangler_health_review_lookup.pngdata_model_wrangler_index.pngdatamodel_wrangler_data_model_list.png 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...