Archive

Why need index when create dataset in Datamodel in Splunk 7.3

longnh26
New Member

Now i using Splunk 7.3 and creating datamodel with search sourcetype but it's false ??
I try with splunk 7.2 and lower then Ok.

Please tell me why? and how to fix it?
alt text

Tags (1)
0 Karma
1 Solution

ivanreis
Builder

All the data ingested at Splunk have to be assigned to an index. Check if the index you are using on version 7.2 is the setup as default at Splunk role assigned to the user you are creating the datamodel. It is possible the index is setup as default for searching.
See below how you can check:
Please navigate to Splunk menu and select:

Settings/Roles and edit the particular role, and check if the index is setup as a default under Indexes tab. If so, then run the same procedure to version 7.3. If the index is not created or assigned to default, then create and setup the configuration.
The best practice is to specify the indexes when you are creating the reports/dashboards/datamodels, etc... to avoid performance issues when running on large environments. So my suggestion is to always use the index to identify your data.
E.g:

index=stream sourcetype=stream:http

alt text

View solution in original post

0 Karma

broberg
Communicator

You should always have a index specified in the datamodel even if its index=* so if you don't have any index anywere, that error seems to be correct.

0 Karma

longnh26
New Member

because this index have many other data, then i think if use only sourcetype to increase performance.

0 Karma

gfreitas
Builder

Maybe if you add index=* it works?

0 Karma

longnh26
New Member

Yes, it's work. But this index have many other data, then i think if use only sourcetype to increase performance.

0 Karma

ivanreis
Builder

All the data ingested at Splunk have to be assigned to an index. Check if the index you are using on version 7.2 is the setup as default at Splunk role assigned to the user you are creating the datamodel. It is possible the index is setup as default for searching.
See below how you can check:
Please navigate to Splunk menu and select:

Settings/Roles and edit the particular role, and check if the index is setup as a default under Indexes tab. If so, then run the same procedure to version 7.3. If the index is not created or assigned to default, then create and setup the configuration.
The best practice is to specify the indexes when you are creating the reports/dashboards/datamodels, etc... to avoid performance issues when running on large environments. So my suggestion is to always use the index to identify your data.
E.g:

index=stream sourcetype=stream:http

alt text

View solution in original post

0 Karma