Security

Data Model

Mohamad_Alaa
Path Finder

is the output of the attached image right?
i can see data model per run duration but by size has no values

Labels (1)
0 Karma
1 Solution

Mohamad_Alaa
Path Finder

problem solved, i appreciate all your responses

once i search in SH, i should use the parameter splunk_server=* in order to see results
So obviously this was my issue as i should see results without such paramter

modified the below on SH, solved it

C:\Program Files\Splunk\etc\system\local\distsearch.conf

[distributedSearch:dmc_group_indexer]

default = false

View solution in original post

0 Karma

Mohamad_Alaa
Path Finder

problem solved, i appreciate all your responses

once i search in SH, i should use the parameter splunk_server=* in order to see results
So obviously this was my issue as i should see results without such paramter

modified the below on SH, solved it

C:\Program Files\Splunk\etc\system\local\distsearch.conf

[distributedSearch:dmc_group_indexer]

default = false

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @Mohamad_Alaa ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mohamad_Alaa ,

you should check if the population scheduled searches are running and if they have results.

It seems that these scheduled searches are running, but they always have empty results.

Are you using CIM>4.X compliant add-ons?

Ciao.

Giuseppe

0 Karma

Mohamad_Alaa
Path Finder

can you elaborate more regarding this point 
"you should check if the population scheduled searches are running and if they have results"
How i can check it?

i installed CIM 5.2.0 and yes i installed TA-addons but not sure about compatibility, do you recommend download to 4.x?

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @Mohamad_Alaa ,

when you choose an add-on from splunkbase, you should check the CIM compliance level.

about population searches, you should see in each Data Model the contrains, this is the population scheduled search

you should try to run these searches and see if you have results,these results are the records in the DataModel.

Ciao.

Giuseppe

0 Karma

Mohamad_Alaa
Path Finder

when i access a data model (authentication for example)
I noticed the below shown error

"This object has no explicit index constraint. Consider adding one for better performance."

0 Karma

Mohamad_Alaa
Path Finder

at the same time i have a message

The search "Network - Traffic Volume Per 30m - Model Gen" is related to the correlation search "Network - Unusual Volume of Network Activity - Rule" but it is not enabled even though the correlation search is; this will cause the correlation to fail

 

0 Karma

Mohamad_Alaa
Path Finder

I added specifically the index, still having same issue
I noticed the below as well

""App configuration
The "Splunk Common Information Model" app has not been fully configured yet.This app has configuration properties that can be customized for this Splunk instance. Depending on the app, these properties may or may not be required.""

but not sure how to proceed already index was added and some data models were accelerated, i only have same button not a next or proceed button

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mohamad_Alaa ,

as I said, you have to enable datamodels and accelerations.

Ciao.

Giuseppe 

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...