Other Usage

Can DMA rebuild/refresh only apply to specific index?

philwong
Explorer

As we known, DMA is applied to indexes that configured in data model conf. 
When we instruct to rebuild/refresh the data model. It will apply all related indexes.

In some situations, we found that data is not synced (raw data is not null but data model is null) on a specific index. We're not clear what's the problem.

But just curious if we can enforce DMA apply an index first? 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @philwong,

did you used all CIM 4.X compliant Add-Ons to parse the data contained in that index?

You have to check if data contained in the index are correctly tagged with the tags of the Data Model you need.

Ciao.

Giuseppe

0 Karma

philwong
Explorer

It's not the first time we run the search and data model. If the target index is others the result is totally fine. So I don't think it's CIM problem. 

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...