Splunk Enterprise Security

Accelerating CIM Validation (S.o.S.) datamodel results in error

damode
Motivator

After accelerating the CIM Validation (S.o.S.) DM and upon checking the pivot for any of the datasets results in an error. Example below:

 

Datamodel 'Splunk_CIM_Validation.Authentication' had an invalid search, cannot get indexes to search

 

 Upon checking the search.log, it states

 

ERROR DataModelEvaluator [3485 BatchSearch] - Data model 'Authentication' was not found.
01-04-2021 12:56:11.393 ERROR SearchOperator:datamodel [3485 BatchSearch] - Error in 'DataModelEvaluator': Data model 'Authentication' was not found.
01-04-2021 12:56:11.394 ERROR TsidxStats [3485 BatchSearch] - Error in 'SearchOperator:datamodel': Error in 'DataModelEvaluator': Data model 'Authentication' was not found.
01-04-2021 12:56:11.394 ERROR TsidxStats [3485 BatchSearch] - sid:etc.splunkcloud.com Datamodel 'Splunk_CIM_Validation.Authentication' had an invalid search, cannot get indexes to search

 

Update: I found some similar posts, where they mention this might be due to permission issue, but I have checked the permission for this DM and it is default to read for "Everyone". Other DMs with same permissions work well.

Also, when acceleration is disabled, it seems shows data in pivot

Can someone please help fix this ?

Labels (1)
0 Karma

scelikok
Champion

On new setup CIM Setup has macros for index whitelist as (*).

If this reply helps you an upvote is appreciated.
0 Karma

scelikok
Champion

Hi @damode,

Splunk ES uses macros to define indexes on datamodels. The reason of the problem is Splunk_CIM_Validation app cannot use that macros and throws that errors. The only way I know is deeltng macros and put the index names into datamodel root searches. But you will loose adding/removing indexes to datamodel settings from CIM setup page.

If your need is checking CIM validation, I suggest you to use CIM-Validator app on Splunkbase. https://splunkbase.splunk.com/app/2968 

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote is appreciated.
0 Karma

damode
Motivator

But this is newly setup Splunk ES on Splunk Cloud.

Could it be probably due to Indexes whitelist using all indexes in the "CIM setup" configuration of the ES app ?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!