All Apps and Add-ons

How to solve the Accelerated Data Model Search Problem in Splunk Common Information Model (CIM)?

MikeElliott
Communicator

Hi Team,

I have recently mapped new sourcetypes to the Web data model, however, when searching using tstats, none of the new sourcetypes are returned in the search results.

When I run the below search, I can see that data from my websense, squid and bluecoat proxies are present in the data model

| datamodel Web Web search | search * | stats count by index, sourcetype | sort -count

However, when attempting to search the data model using tstats, only websense and squid show up in the search results.

| tstats summariesonly=t prestats=f count from datamodel=Web.Web WHERE sourcetype=* BY sourcetype Web.src Web.site Web.dest Web.url | dedup sourcetype

Does anyone have any ideas what has gone wrong?

aamer86
Path Finder

I had this issue

A data model names Web that includes my WAF source type
I created another DM named after my WAF, this caused my WAF not to show in the results as a sourcetype when querying the Web DM

So i removed the created DM and it worked again

0 Karma

p_gurav
Champion

is the acceleration completed? and if your are doing by sourcetype why sourcetype=*, is sourcetype field has null values?

0 Karma

MikeElliott
Communicator

can confirm, data model acceleration is at 100%. sourcetype=* was chosen as sourcetype=bluecoat wasn't working and wanted to see if any of the other sourcetypes were present in the search results.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...