PCI does not show any data

[imontanoisoft]

Hi Splunkers,
I have installed PCI in my Linux (rhel 6.3) environment and in the PCI app I do not see any data.

I followed the steps in : https://docs.splunk.com/Documentation/PCI/3.7.2/Install/Assets#Format_asset_data_as_a_lookup

I have a forwarder that is sending data to splunk.

I am sending the last lines from splunkd.log

01-10-2019 11:30:32.371 -0500 WARN SearchEvaluatorBasedExpander - sid: Unable to find tag messaging
01-10-2019 11:30:32.767 -0500 WARN SearchEvaluatorBasedExpander - sid: Unable to find tag jvm
01-10-2019 11:30:32.902 -0500 WARN SearchEvaluatorBasedExpander - sid: Unable to find tag malware
01-10-2019 11:30:33.082 -0500 WARN SearchEvaluatorBasedExpander - sid: Unable to find tag malware
01-10-2019 11:30:33.082 -0500 WARN SearchEvaluatorBasedExpander - sid: Unable to find tag operations
01-10-2019 11:30:33.211 -0500 WARN SearchEvaluatorBasedExpander - sid: Unable to find tag resolution
01-10-2019 11:30:33.892 -0500 WARN SearchEvaluatorBasedExpander - sid: Unable to find tag facilities
01-10-2019 11:30:33.942 -0500 WARN SearchEvaluatorBasedExpander - sid: Eventtype 'gconfd_Linux_syslog' does not exist or is disabled.
01-10-2019 11:30:33.947 -0500 WARN SearchEvaluatorBasedExpander - sid: Eventtype 'gdm_Linux_general_syslog' does not exist or is disabled.
01-10-2019 11:30:33.953 -0500 WARN SearchEvaluatorBasedExpander - sid: Eventtype 'hpoid' does not exist or is disabled.
01-10-2019 11:30:33.961 -0500 WARN SearchEvaluatorBasedExpander - sid: Eventtype 'nix_agpart' does not exist or is disabled.
01-10-2019 11:30:33.966 -0500 WARN SearchEvaluatorBasedExpander - sid: Eventtype 'nix_configuration_change' does not exist or is disabled.
01-10-2019 11:30:33.975 -0500 WARN SearchEvaluatorBasedExpander - sid: Eventtype 'nix_kernel' does not exist or is disabled.
01-10-2019 11:30:33.989 -0500 WARN SearchEvaluatorBasedExpander - sid: Eventtype 'unix_runlevel_change' does not exist or is disabled.
01-10-2019 11:30:36.692 -0500 WARN SearchEvaluatorBasedExpander - sid: Unable to find tag ticketing
01-10-2019 11:30:37.703 -0500 WARN SearchEvaluatorBasedExpander - sid: Unable to find tag web
01-10-2019 11:30:38.484 -0500 ERROR DataModelCache - Invalid or unaccelerable root object for datamodel
01-10-2019 11:30:38.484 -0500 WARN ReadSummaryDirective - sid: Issue occurred with data model 'Splunk_Audit.Scheduler_Activity'. Issue: 'Failed to generate dmid' Reason: 'Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel'.
01-10-2019 11:30:38.484 -0500 WARN ReadSummaryDirective - sid: Failed to parse options. Clearing out read-summary arguments.
01-10-2019 11:30:38.672 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:38.674 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:38.842 -0500 ERROR DataModelCache - Invalid or unaccelerable root object for datamodel
01-10-2019 11:30:38.843 -0500 WARN ReadSummaryDirective - sid: Issue occurred with data model 'Splunk_Audit.Web_Service_Errors'. Issue: 'Failed to generate dmid' Reason: 'Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel'.
01-10-2019 11:30:38.843 -0500 WARN ReadSummaryDirective - sid: Failed to parse options. Clearing out read-summary arguments.
01-10-2019 11:30:39.169 -0500 ERROR DataModelCache - Invalid or unaccelerable root object for datamodel
01-10-2019 11:30:39.170 -0500 WARN ReadSummaryDirective - sid: Issue occurred with data model 'Malware.Malware_Operations'. Issue: 'Failed to generate dmid' Reason: 'Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel'.
01-10-2019 11:30:39.170 -0500 WARN ReadSummaryDirective - sid: Failed to parse options. Clearing out read-summary arguments.
01-10-2019 11:30:39.499 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:39.500 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:40.391 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:40.393 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:40.736 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:40.737 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:40.798 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:40.799 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:41.027 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:41.028 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:42.741 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:42.742 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:43.162 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:43.163 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:43.530 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:43.531 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:43.723 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:43.724 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:44.743 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:44.744 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:45.358 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:45.359 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:46.220 -0500 ERROR SearchOperator:filter - Error in 'where' command: The expression is malformed. An unexpected character is reached at '* AND hourDiff>) '.
01-10-2019 11:30:46.436 -0500 ERROR SearchOperator:rename - Error in 'rename' command: Usage: rename [old_name AS/TO/-> new_name]+.
01-10-2019 11:30:46.447 -0500 ERROR SearchOperator:rename - Error in 'rename' command: Usage: rename [old_name AS/TO/-> new_name]+.
01-10-2019 11:30:46.913 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:46.914 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:46.961 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:46.962 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:47.128 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:47.129 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:47.329 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:47.330 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid.
01-10-2019 11:30:47.366 -0500 ERROR SearchParser - Missing a search command before ''. Error at position '2' of search query '| * | where isnotnull() | search * * * | sort +d'.
01-10-2019 11:30:47.501 -0500 ERROR SearchOperator:filter - Error in 'where' command: The expression is malformed. An unexpected character is reached at ' '.
01-10-2019 11:30:47.778 -0500 ERROR TsidxStats - Wildcards () are not supported in aggregate fields
01-10-2019 11:30:47.786 -0500 ERROR TsidxStats - Wildcards () are not supported in aggregate fields
01-10-2019 11:38:13.756 -0500 INFO ClientSessionsManager:Listener_AppEvents - Received count=1 AppEvent from DC ip=192.168.204.1 name=AEC625E5-FB82-4AD0-B10F-35CCADACD4CF