All Apps and Add-ons

Why are we getting error "The search for datamodel 'TS2' failed to parse, cannot get indexes to search" on a search head with the OPTIC Splunk App?

bigtyma
Communicator

"The search for datamodel 'TS2' failed to parse, cannot get indexes to search"

We are receiving this error on a search head that is hosting the Threatstream/Optic app.

The data model is accelerated and the base search used to generate the constraints is working.

Any ideas or troubleshooting advice is appreciated.

Thank you

0 Karma

jordanperks
Path Finder

I fixed this issue on the Malware Datamodel that ships with CIM app by disabling or editing any eventtype tag search that used a macro and tags malware/attack.

0 Karma

bigtyma
Communicator

Update: I have disabled acceleration for this data model and now the pivot is working correctly. However we would like for acceleration to work. Ideas?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...