Data model wrangler dashboard not populating

[slider8p2023]

Hi 

We've setup the Data Model Wrangler App in our on-prem Search Head. We're running Splunk Core 9.0.3 and ES 7.0.1 

The latest SA-cim-validator and CIM App are installed as per the installation notes. These apps are working as expected showing results from the validator app.

I created an index from the Splunk WebUI visible under the DM Wrangler App called data_model_wrangler.

We've scheduled the 3 saved searches that come with the App as per the instructions.

We only see results out of 1 from the 3 saved searches from the DM Wrangler App.  Also the index created is empty.

This being 

data_model_wrangler_dm_index_sourcetype_field

 The two other saved searches are:

data_model_wrangler_field_quality

data_model_wrangler_mapping_quality

with errors:

No results to summary index.

All saved searches and indexes are enabled.

Can anyone please suggest where we've gone wrong in setting this up?

@nvonkorff 

Thanks in advance

[gcusello]

Hi @slider8p2023,

did you customized the three macros that are present in this app to populate the lookups?

they are:

• `data_model_wrangler_index`
  • Index to which summary data will be sent
  • Default: data_model_wrangler
• `datamodel_wrangler_data_model_list`
  • Comma separated list of data models to monitor
  • Default: Authentication, Change, Change_Analysis, DLP, Databases, Email, Endpoint, Intrusion_Detection, Malware, Network_Resolution, Network_Sessions, Network_Traffic, Web
• `data_model_wrangler_health_review_lookup`
  • The name of the lookup containing review information
  • Default: data_model_wrangler_health_review.csv

Put attention especially to the first  that contains the list of indexer to check.

Ciao.

Giuseppe

[slider8p2023]

Hi @gcusello 

I checked the macros again and they contain the same values you listed earlier.

Unless we've missed something, very basic they look in order. I've attached the screenshots of the macro configs.
I believe they are correct? They were all self populated when the App was installed. There are no details about special settings for the index which I created via the WebUI with the suggested default index name.

Thanks again