When I pivot a particular datamodel, I get this error, "Datamodel 'Splunk_CIM_Validation.Vulnerabilities' had an invalid search, cannot get indexes to search"
After inspecting the search.log, I noticed these two error messsages.
07-08-2020 20:16:24.484 ERROR AdminManagerValidation - 'undefineduundefined' is not a time string.
07-08-2020 20:16:24.484 ERROR DataModelValidator - 'undefineduundefined' is not a time string.
Can someone please help how to fix this issue ?
here is a similar topic. did you try those steps?
in a nutshell you should check the datamodel and the macro and look what's in it. if the datamodel uses a macro and this particular macro tries to search an index that doesn't exist, you get an error. if the SPL within the datamodel/macro lacks something, you get an error.
you can expand macros btw with STRG (or command)+Shift+E
hope that helps