Archive

Why need index when create dataset in Datamodel in Splunk 7.3

New Member

Now i using Splunk 7.3 and creating datamodel with search sourcetype but it's false ??
I try with splunk 7.2 and lower then Ok.

Please tell me why? and how to fix it?
alt text

Tags (1)
0 Karma
1 Solution

Builder

All the data ingested at Splunk have to be assigned to an index. Check if the index you are using on version 7.2 is the setup as default at Splunk role assigned to the user you are creating the datamodel. It is possible the index is setup as default for searching.
See below how you can check:
Please navigate to Splunk menu and select:

Settings/Roles and edit the particular role, and check if the index is setup as a default under Indexes tab. If so, then run the same procedure to version 7.3. If the index is not created or assigned to default, then create and setup the configuration.
The best practice is to specify the indexes when you are creating the reports/dashboards/datamodels, etc... to avoid performance issues when running on large environments. So my suggestion is to always use the index to identify your data.
E.g:

index=stream sourcetype=stream:http

alt text

View solution in original post

0 Karma

Communicator

You should always have a index specified in the datamodel even if its index=* so if you don't have any index anywere, that error seems to be correct.

0 Karma

New Member

because this index have many other data, then i think if use only sourcetype to increase performance.

0 Karma

Builder

Maybe if you add index=* it works?

0 Karma

New Member

Yes, it's work. But this index have many other data, then i think if use only sourcetype to increase performance.

0 Karma

Builder

All the data ingested at Splunk have to be assigned to an index. Check if the index you are using on version 7.2 is the setup as default at Splunk role assigned to the user you are creating the datamodel. It is possible the index is setup as default for searching.
See below how you can check:
Please navigate to Splunk menu and select:

Settings/Roles and edit the particular role, and check if the index is setup as a default under Indexes tab. If so, then run the same procedure to version 7.3. If the index is not created or assigned to default, then create and setup the configuration.
The best practice is to specify the indexes when you are creating the reports/dashboards/datamodels, etc... to avoid performance issues when running on large environments. So my suggestion is to always use the index to identify your data.
E.g:

index=stream sourcetype=stream:http

alt text

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!