Data Model

[Mohamad_Alaa]

is the output of the attached image right?
i can see data model per run duration but by size has no values

[Mohamad_Alaa · Accepted solution]

problem solved, i appreciate all your responses

once i search in SH, i should use the parameter splunk_server=* in order to see results
So obviously this was my issue as i should see results without such paramter

modified the below on SH, solved it

C:\Program Files\Splunk\etc\system\local\distsearch.conf

[distributedSearch:dmc_group_indexer]

default = false

[gcusello]

hi @Mohamad_Alaa ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @Mohamad_Alaa ,

you should check if the population scheduled searches are running and if they have results.

It seems that these scheduled searches are running, but they always have empty results.

Are you using CIM>4.X compliant add-ons?

Ciao.

Giuseppe

[Mohamad_Alaa]

can you elaborate more regarding this point 
"you should check if the population scheduled searches are running and if they have results"
How i can check it?

i installed CIM 5.2.0 and yes i installed TA-addons but not sure about compatibility, do you recommend download to 4.x?

[gcusello]

hi @Mohamad_Alaa ,

when you choose an add-on from splunkbase, you should check the CIM compliance level.

about population searches, you should see in each Data Model the contrains, this is the population scheduled search

you should try to run these searches and see if you have results,these results are the records in the DataModel.

Ciao.

Giuseppe

[Mohamad_Alaa]

when i access a data model (authentication for example)
I noticed the below shown error

"This object has no explicit index constraint. Consider adding one for better performance."

[Mohamad_Alaa]

at the same time i have a message

The search "Network - Traffic Volume Per 30m - Model Gen" is related to the correlation search "Network - Unusual Volume of Network Activity - Rule" but it is not enabled even though the correlation search is; this will cause the correlation to fail

[Mohamad_Alaa]

I added specifically the index, still having same issue
I noticed the below as well

""App configuration
The "Splunk Common Information Model" app has not been fully configured yet.This app has configuration properties that can be customized for this Splunk instance. Depending on the app, these properties may or may not be required.""

but not sure how to proceed already index was added and some data models were accelerated, i only have same button not a next or proceed button

[gcusello]

Hi @Mohamad_Alaa ,

as I said, you have to enable datamodels and accelerations.

Ciao.

Giuseppe