All Apps and Add-ons

How to solve the Accelerated Data Model Search Problem in Splunk Common Information Model (CIM)?

MikeElliott
Communicator

Hi Team,

I have recently mapped new sourcetypes to the Web data model, however, when searching using tstats, none of the new sourcetypes are returned in the search results.

When I run the below search, I can see that data from my websense, squid and bluecoat proxies are present in the data model

| datamodel Web Web search | search * | stats count by index, sourcetype | sort -count

However, when attempting to search the data model using tstats, only websense and squid show up in the search results.

| tstats summariesonly=t prestats=f count from datamodel=Web.Web WHERE sourcetype=* BY sourcetype Web.src Web.site Web.dest Web.url | dedup sourcetype

Does anyone have any ideas what has gone wrong?

aamer86
Path Finder

I had this issue

A data model names Web that includes my WAF source type
I created another DM named after my WAF, this caused my WAF not to show in the results as a sourcetype when querying the Web DM

So i removed the created DM and it worked again

0 Karma

p_gurav
Champion

is the acceleration completed? and if your are doing by sourcetype why sourcetype=*, is sourcetype field has null values?

0 Karma

MikeElliott
Communicator

can confirm, data model acceleration is at 100%. sourcetype=* was chosen as sourcetype=bluecoat wasn't working and wanted to see if any of the other sourcetypes were present in the search results.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...