Security

Data Model

Mohamad_Alaa
Path Finder

is the output of the attached image right?
i can see data model per run duration but by size has no values

0 Karma
1 Solution

Mohamad_Alaa
Path Finder

problem solved, i appreciate all your responses

once i search in SH, i should use the parameter splunk_server=* in order to see results
So obviously this was my issue as i should see results without such paramter

modified the below on SH, solved it

C:\Program Files\Splunk\etc\system\local\distsearch.conf

[distributedSearch:dmc_group_indexer]

default = false

View solution in original post

0 Karma

Mohamad_Alaa
Path Finder

problem solved, i appreciate all your responses

once i search in SH, i should use the parameter splunk_server=* in order to see results
So obviously this was my issue as i should see results without such paramter

modified the below on SH, solved it

C:\Program Files\Splunk\etc\system\local\distsearch.conf

[distributedSearch:dmc_group_indexer]

default = false

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @Mohamad_Alaa ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mohamad_Alaa ,

you should check if the population scheduled searches are running and if they have results.

It seems that these scheduled searches are running, but they always have empty results.

Are you using CIM>4.X compliant add-ons?

Ciao.

Giuseppe

0 Karma

Mohamad_Alaa
Path Finder

can you elaborate more regarding this point 
"you should check if the population scheduled searches are running and if they have results"
How i can check it?

i installed CIM 5.2.0 and yes i installed TA-addons but not sure about compatibility, do you recommend download to 4.x?

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @Mohamad_Alaa ,

when you choose an add-on from splunkbase, you should check the CIM compliance level.

about population searches, you should see in each Data Model the contrains, this is the population scheduled search

you should try to run these searches and see if you have results,these results are the records in the DataModel.

Ciao.

Giuseppe

0 Karma

Mohamad_Alaa
Path Finder

when i access a data model (authentication for example)
I noticed the below shown error

"This object has no explicit index constraint. Consider adding one for better performance."

0 Karma

Mohamad_Alaa
Path Finder

at the same time i have a message

The search "Network - Traffic Volume Per 30m - Model Gen" is related to the correlation search "Network - Unusual Volume of Network Activity - Rule" but it is not enabled even though the correlation search is; this will cause the correlation to fail

 

0 Karma

Mohamad_Alaa
Path Finder

I added specifically the index, still having same issue
I noticed the below as well

""App configuration
The "Splunk Common Information Model" app has not been fully configured yet.This app has configuration properties that can be customized for this Splunk instance. Depending on the app, these properties may or may not be required.""

but not sure how to proceed already index was added and some data models were accelerated, i only have same button not a next or proceed button

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mohamad_Alaa ,

as I said, you have to enable datamodels and accelerations.

Ciao.

Giuseppe 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...