All Apps and Add-ons

Why are we getting error "The search for datamodel 'TS2' failed to parse, cannot get indexes to search" on a search head with the OPTIC Splunk App?

bigtyma
Communicator

"The search for datamodel 'TS2' failed to parse, cannot get indexes to search"

We are receiving this error on a search head that is hosting the Threatstream/Optic app.

The data model is accelerated and the base search used to generate the constraints is working.

Any ideas or troubleshooting advice is appreciated.

Thank you

0 Karma

jordanperks
Path Finder

I fixed this issue on the Malware Datamodel that ships with CIM app by disabling or editing any eventtype tag search that used a macro and tags malware/attack.

0 Karma

bigtyma
Communicator

Update: I have disabled acceleration for this data model and now the pivot is working correctly. However we would like for acceleration to work. Ideas?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...