errormessage "JSON file contents not available." when configure DM in different apps

[schose]

Hi all,

I want to configure a Datamodel in different apps. On app should define the datamodel (here search). The seconds app should (here: dm_acc) should define schedule and acceleration.

andreas@art-mb-2.local:~/splunk/etc/apps$ cat search/metadata/local.meta

[datamodels/metricbeat]
access = read : [ * ], write : [ admin ]
owner = testuser

[models/metricbeat]
access = read : [ * ], write : [ admin ]
owner = testuser

andreas@art-mb-2.local:~/splunk/etc/apps$ cat search/local/datamodels.conf​
[metricbeat]
#acceleration = true
#acceleration.earliest_time = 0
acceleration.hunk.dfs_block_size = 0

andreas@art-mb-2.local:~/splunk/etc/apps/dm_acc$ cat default/datamodels.conf
[metricbeat]
acceleration = true
acceleration.earliest_time = 0
acceleration.cron_schedule = * * * * *

andreas@art-mb-2.local:~/splunk/etc/apps/dm_acc$ cat metadata/local.meta
[]
access = read : [ * ], write : [ admin ]
export = system

this seems to work fine so far. I can query the DM using

| tstats summariesonly=t count values(host) from datamodel=metricbeat

Unfurtunaly I'm receiving an error message: "Error in data model "metricbeat" : JSON file contents not available." when using the WebGUI and access Datamodels.

Any hint's?! Does this look like a GUI bug?!

Regards,

Andreas

[caseyp_splunk]

The default datamodel.conf has a comment at the top of the page referencing a bug which seems to be fixed in a really old version of splunk..

## per SPL-66827: data models and their acceleration params (datamodels.conf) must live in the same app

As for the error messages you get in the UI, when you click the next page or the dropdown to show more datamodels, the error message goes away.

Error in data model "<DATAMODEL>" : JSON file contents not available.

[woodcock]

This does not work; I, too, tried and failed to do similar with the CIM, and had the same problems. The best that you can do is create a soft or had link from the other app to the JSON in the source app, but this will break if you are using the DS to push. You can create a P0 support ticket which Splunk considers an Enhancement Request but do not expect much to happen.a