All Apps and Add-ons

Data model wrangler dashboard not populating



We've setup the Data Model Wrangler App in our on-prem Search Head. We're running Splunk Core 9.0.3 and ES 7.0.1 

The latest SA-cim-validator and CIM App are installed as per the installation notes. These apps are working as expected showing results from the validator app.

I created an index from the Splunk WebUI visible under the DM Wrangler App called data_model_wrangler.

We've scheduled the 3 saved searches that come with the App as per the instructions.

We only see results out of 1 from the 3 saved searches from the DM Wrangler App.  Also the index created is empty.

This being 


 The two other saved searches are:

with errors:
No results to summary index.

All saved searches and indexes are enabled.

Can anyone please suggest where we've gone wrong in setting this up?


Thanks in advance

Labels (1)
0 Karma


Hi @slider8p2023,

did you customized the three macros that are present in this app to populate the lookups?

they are:

  • `data_model_wrangler_index`
    • Index to which summary data will be sent
    • Default: data_model_wrangler
  • `datamodel_wrangler_data_model_list`
    • Comma separated list of data models to monitor
    • Default: Authentication, Change, Change_Analysis, DLP, Databases, Email, Endpoint, Intrusion_Detection, Malware, Network_Resolution, Network_Sessions, Network_Traffic, Web
  • `data_model_wrangler_health_review_lookup`
    • The name of the lookup containing review information
    • Default: data_model_wrangler_health_review.csv

Put attention especially to the first  that contains the list of indexer to check.



0 Karma


Hi @gcusello 

I checked the macros again and they contain the same values you listed earlier.

Unless we've missed something, very basic they look in order. I've attached the screenshots of the macro configs.
I believe they are correct? They were all self populated when the App was installed. There are no details about special settings for the index which I created via the WebUI with the suggested default index name.

Thanks againdata_model_wrangler_health_review_lookup.pngdata_model_wrangler_index.pngdatamodel_wrangler_data_model_list.png 

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...