Knowledge Management

Datamodel issues

damode
Motivator

When I pivot a particular datamodel, I get this error, "Datamodel 'Splunk_CIM_Validation.Vulnerabilities' had an invalid search, cannot get indexes to search"

After inspecting the search.log, I noticed these two error messsages.

07-08-2020 20:16:24.484 ERROR AdminManagerValidation - 'undefineduundefined' is not a time string.
07-08-2020 20:16:24.484 ERROR DataModelValidator - 'undefineduundefined' is not a time string.

Can someone please help how to fix this issue ?

Labels (1)
0 Karma
1 Solution

damode
Motivator

Thanks for your help. I was able to fix the issue by disabling the datamodel acceleration which was still stuck on "building" status.

View solution in original post

0 Karma

misterduke
Explorer

Hello,

 

here is a similar topic. did you try those steps? 

in a nutshell you should check the datamodel and the macro and look what's in it. if the datamodel uses a macro and this particular macro tries to search an index that doesn't exist, you get an error. if the SPL within the datamodel/macro lacks something, you get an error.

 

you can expand macros btw with STRG (or command)+Shift+E

 

hope that helps

0 Karma

damode
Motivator

Thanks for your help. I was able to fix the issue by disabling the datamodel acceleration which was still stuck on "building" status.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...