Knowledge Management

Datamodel issues

damode
Motivator

When I pivot a particular datamodel, I get this error, "Datamodel 'Splunk_CIM_Validation.Vulnerabilities' had an invalid search, cannot get indexes to search"

After inspecting the search.log, I noticed these two error messsages.

07-08-2020 20:16:24.484 ERROR AdminManagerValidation - 'undefineduundefined' is not a time string.
07-08-2020 20:16:24.484 ERROR DataModelValidator - 'undefineduundefined' is not a time string.

Can someone please help how to fix this issue ?

Labels (1)
0 Karma
1 Solution

damode
Motivator

Thanks for your help. I was able to fix the issue by disabling the datamodel acceleration which was still stuck on "building" status.

View solution in original post

0 Karma

misterduke
Explorer

Hello,

 

here is a similar topic. did you try those steps? 

in a nutshell you should check the datamodel and the macro and look what's in it. if the datamodel uses a macro and this particular macro tries to search an index that doesn't exist, you get an error. if the SPL within the datamodel/macro lacks something, you get an error.

 

you can expand macros btw with STRG (or command)+Shift+E

 

hope that helps

0 Karma

damode
Motivator

Thanks for your help. I was able to fix the issue by disabling the datamodel acceleration which was still stuck on "building" status.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...