Deployment Architecture
Highlighted

Why are we are receiving error "-0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found" search head instances?

Motivator

Hi All,

We are getting this error in Splunk search head instances -0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found.

We are getting the above error message in splunkd.log, not sure what as went wrong really and why we are getting this error message in splunkd.log after restarting the Splunk services. Kindly guide us in fixing this issue.

0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found.
0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found.
0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found.
0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found.

thanks in advance.

0 Karma
Highlighted

Re: Why are we are receiving error "-0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found" search head instances?

Motivator

Hi All, Can anyone throw me some lights on this error .

thanks in advance.

0 Karma
Highlighted

Re: Why are we are receiving error "-0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found" search head instances?

Explorer

For now, all the light I can shed is that I see athe exact same error (different data model though) with one of my Splunk customers. The "-0500" in the beginning of your line is your time zone, so not really a part of the message. I will post my findings if I figure out what is going on with this error message.

0 Karma
Highlighted

Re: Why are we are receiving error "-0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found" search head instances?

Explorer

Found this here on Answers

0 Karma
Highlighted

Re: Why are we are receiving error "-0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found" search head instances?

Motivator

thanks sves for you are update.

0 Karma
Highlighted

Re: Why are we are receiving error "-0500 ERROR DataModelEvaluator - Data model 'Security_DSB' was not found" search head instances?

Explorer

In the case of my customer, the data model json file was missing, and the datamodels.conf was set up with acceleration = 1. So every 5 minutes, Splunk would be complaining. Simply removing references to the missing data model is an easy fix. Or, recreate the data model from backup if one is available.

I see in other cases this has to do with permission - check out this answers article

0 Karma