Security

Security Essentials Accelerated DataModel- App tells me that there isn't the accelerated "Change" Data Model

gcusello
SplunkTrust
SplunkTrust

Hi at all,

I'm trying to implement some Use Cases from Security Essentials App, using AWS data.

I found the following problem:

I'd like to use a Use case called "Multiple Account Deletion by an Administrator" but the App tells me that there isn't the accelerated "Change" Data Model, that instead is present and accelerated.

gcusello_0-1652711941135.png

The strange thing is that the message doesn't say that there isn't data, but that there isn't an accelerated DataModel.

Where could I search the problem?

Thank you in advance.

Ciao.

Giuseppe

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...