How to solve the Accelerated Data Model Search Problem in Splunk Common Information Model (CIM)?

[MikeElliott]

Hi Team,

I have recently mapped new sourcetypes to the Web data model, however, when searching using tstats, none of the new sourcetypes are returned in the search results.

When I run the below search, I can see that data from my websense, squid and bluecoat proxies are present in the data model

| datamodel Web Web search | search * | stats count by index, sourcetype | sort -count

However, when attempting to search the data model using tstats, only websense and squid show up in the search results.

| tstats summariesonly=t prestats=f count from datamodel=Web.Web WHERE sourcetype=* BY sourcetype Web.src Web.site Web.dest Web.url | dedup sourcetype

Does anyone have any ideas what has gone wrong?

[aamer86]

I had this issue

A data model names Web that includes my WAF source type
I created another DM named after my WAF, this caused my WAF not to show in the results as a sourcetype when querying the Web DM

So i removed the created DM and it worked again

[p_gurav]

is the acceleration completed? and if your are doing by sourcetype why sourcetype=*, is sourcetype field has null values?

[MikeElliott]

can confirm, data model acceleration is at 100%. sourcetype=* was chosen as sourcetype=bluecoat wasn't working and wanted to see if any of the other sourcetypes were present in the search results.