errormessage "JSON file contents not available." when configure DM in different apps


Hi all,

I want to configure a Datamodel in different apps. On app should define the datamodel (here search). The seconds app should (here: dm_acc) should define schedule and acceleration.

andreas@art-mb-2.local:~/splunk/etc/apps$ cat search/metadata/local.meta

access = read : [ * ], write : [ admin ]
owner = testuser

access = read : [ * ], write : [ admin ]
owner = testuser

andreas@art-mb-2.local:~/splunk/etc/apps$ cat search/local/datamodels.conf​
#acceleration = true
#acceleration.earliest_time = 0
acceleration.hunk.dfs_block_size = 0

andreas@art-mb-2.local:~/splunk/etc/apps/dm_acc$ cat default/datamodels.conf
acceleration = true
acceleration.earliest_time = 0
acceleration.cron_schedule = * * * * *

andreas@art-mb-2.local:~/splunk/etc/apps/dm_acc$ cat metadata/local.meta
access = read : [ * ], write : [ admin ]
export = system

this seems to work fine so far. I can query the DM using

| tstats summariesonly=t count values(host) from datamodel=metricbeat

Unfurtunaly I'm receiving an error message: "Error in data model "metricbeat" : JSON file contents not available." when using the WebGUI and access Datamodels.

Any hint's?! Does this look like a GUI bug?!



0 Karma

Splunk Employee
Splunk Employee

The default datamodel.conf has a comment at the top of the page referencing a bug which seems to be fixed in a really old version of splunk..

## per SPL-66827: data models and their acceleration params (datamodels.conf) must live in the same app


As for the error messages you get in the UI, when you click the next page or the dropdown to show more datamodels, the error message goes away.

Error in data model "<DATAMODEL>" : JSON file contents not available.



0 Karma

Esteemed Legend

This does not work; I, too, tried and failed to do similar with the CIM, and had the same problems. The best that you can do is create a soft or had link from the other app to the JSON in the source app, but this will break if you are using the DS to push. You can create a P0 support ticket which Splunk considers an Enhancement Request but do not expect much to happen.a

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...