All Apps and Add-ons

Trying to install and app into Splunk 6.4.3 and getting Datamodles issues

robertlynch2020
Motivator

Hi

I have developed and a app in 7.0.3 and we are testing it to import into Splunk 6.4.3.
I have multiple dashboards with multiple Datamodles, However i am getting an strange errors from the Datamodles. It is telling me for example the field "memory" all ready exists in another datamodel. This me this is very strange and i don't link the Datamodles. They are all separate. Why would impact another + when i was creating them this was not an issue?

Error in model "MXTIMING_RATE_CURVE" : Cannot add field 'Context' because it already exists in object 'MXTIMING'.
Error in model "MXTIMING_RATE_CURVE_Status_Y" : Cannot add field 'Context' because it already exists in object 'MXTIMING'.
Error in model "MXTIMING_V8" : Cannot add field 'Memory' because it already exists in object 'MXTIMING'.
Error in model "MXTIMING_V8_5_Seconds" : Cannot add field 'Memory' because it already exists in object 'MXTIMING'.
Error in model "QCST" : Cannot add field 'ActivityType' because it already exists in object 'qcst'.
Error in model "QCST_BETA" : Cannot add field 'ActivityType' because it already exists in object 'qcst'.

1 Solution

robertlynch2020
Motivator

Hi

In The end was a version issues, in the later version you can overwrite a field "context" in CALCULATED, but in the earler version you cant. So i had to change the name of "context" to "context2" in the CALCULATED and it worked -

Thanks For your help on this
Robert

View solution in original post

robertlynch2020
Motivator

Hi

In The end was a version issues, in the later version you can overwrite a field "context" in CALCULATED, but in the earler version you cant. So i had to change the name of "context" to "context2" in the CALCULATED and it worked -

Thanks For your help on this
Robert

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Its not that ANOTHER data model exists its another OBJECT in the SAME data model with the SAME field extraction already exists.

If you look at this sample data model that comes with splunk:

alt text

The "OBJECTS" i speak of are on the left side... "Audit" is a root event search, and the searches below it make use of every extraction that has come before it. So if i extract a field called JKAT54 in the Audit root event search, then I cant extract it again in the Searches child event search.

Make sense?

0 Karma

robertlynch2020
Motivator

Cheers - This is perfect.

robertlynch2020
Motivator

Hi

![alt text][1]I cant import on the old version, but i can on Splunk 7.0.2. Without issue.

So now i need a workaround, as i need to get this into the app.

C:\Users\rlynch\Desktop\Quick_Work\Greenhorn\2018-05-15+15_53_13-Edit+Objects_+MXTIMING1_RATE_CURVE_CLONE_TOBE_DELETED+_+Splunk+7.1.0.png

0 Karma

jkat54
SplunkTrust
SplunkTrust

Try “downloading” or “exporting the data model and look at the json... See if you can find the duplicate that way.

0 Karma

robertlynch2020
Motivator

Hi

In The end was a version issues, in the later version you can overwrite a field "context" in CALCULATED, but in the earler version you cant. So i had to change the name of "context" to "context2" in the CALCULATED and it worked -

Thanks For your help on this
Robert

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!