Security

Data Model

Mohamad_Alaa
Path Finder

is the output of the attached image right?
i can see data model per run duration but by size has no values

Labels (1)
0 Karma
1 Solution

Mohamad_Alaa
Path Finder

problem solved, i appreciate all your responses

once i search in SH, i should use the parameter splunk_server=* in order to see results
So obviously this was my issue as i should see results without such paramter

modified the below on SH, solved it

C:\Program Files\Splunk\etc\system\local\distsearch.conf

[distributedSearch:dmc_group_indexer]

default = false

View solution in original post

0 Karma

Mohamad_Alaa
Path Finder

problem solved, i appreciate all your responses

once i search in SH, i should use the parameter splunk_server=* in order to see results
So obviously this was my issue as i should see results without such paramter

modified the below on SH, solved it

C:\Program Files\Splunk\etc\system\local\distsearch.conf

[distributedSearch:dmc_group_indexer]

default = false

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @Mohamad_Alaa ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mohamad_Alaa ,

you should check if the population scheduled searches are running and if they have results.

It seems that these scheduled searches are running, but they always have empty results.

Are you using CIM>4.X compliant add-ons?

Ciao.

Giuseppe

0 Karma

Mohamad_Alaa
Path Finder

can you elaborate more regarding this point 
"you should check if the population scheduled searches are running and if they have results"
How i can check it?

i installed CIM 5.2.0 and yes i installed TA-addons but not sure about compatibility, do you recommend download to 4.x?

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @Mohamad_Alaa ,

when you choose an add-on from splunkbase, you should check the CIM compliance level.

about population searches, you should see in each Data Model the contrains, this is the population scheduled search

you should try to run these searches and see if you have results,these results are the records in the DataModel.

Ciao.

Giuseppe

0 Karma

Mohamad_Alaa
Path Finder

when i access a data model (authentication for example)
I noticed the below shown error

"This object has no explicit index constraint. Consider adding one for better performance."

0 Karma

Mohamad_Alaa
Path Finder

at the same time i have a message

The search "Network - Traffic Volume Per 30m - Model Gen" is related to the correlation search "Network - Unusual Volume of Network Activity - Rule" but it is not enabled even though the correlation search is; this will cause the correlation to fail

 

0 Karma

Mohamad_Alaa
Path Finder

I added specifically the index, still having same issue
I noticed the below as well

""App configuration
The "Splunk Common Information Model" app has not been fully configured yet.This app has configuration properties that can be customized for this Splunk instance. Depending on the app, these properties may or may not be required.""

but not sure how to proceed already index was added and some data models were accelerated, i only have same button not a next or proceed button

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mohamad_Alaa ,

as I said, you have to enable datamodels and accelerations.

Ciao.

Giuseppe 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...