Getting Data In

Error Message; The search for datamodel 'abc_123' failed to parse, cannot get indexes to search?

mcrawford44
Communicator

I have two indexers in peer that share 1 index, and 1 data model. Both indexers are configured identically. Both data models are accelerated, and responsive to the '| datamodel' command.

When running a dashboard on our search head that uses the data model, we get the following message;

[indexer_2] The search for datamodel 'abc_123' failed to parse, cannot get indexes to search

When searching normally across peers, there are no errors and both indexers are responsive. When acceleration is disabled, there are no errors. However I would like to keep this feature.

1 Solution

dmaislin_splunk
Splunk Employee
Splunk Employee

Remove any macro definitions from your data models and expand them. It will work fine after that.

View solution in original post