Splunk Enterprise Security

Accelerating CIM Validation (S.o.S.) datamodel results in error

damode
Motivator

After accelerating the CIM Validation (S.o.S.) DM and upon checking the pivot for any of the datasets results in an error. Example below:

 

Datamodel 'Splunk_CIM_Validation.Authentication' had an invalid search, cannot get indexes to search

 

 Upon checking the search.log, it states

 

ERROR DataModelEvaluator [3485 BatchSearch] - Data model 'Authentication' was not found.
01-04-2021 12:56:11.393 ERROR SearchOperator:datamodel [3485 BatchSearch] - Error in 'DataModelEvaluator': Data model 'Authentication' was not found.
01-04-2021 12:56:11.394 ERROR TsidxStats [3485 BatchSearch] - Error in 'SearchOperator:datamodel': Error in 'DataModelEvaluator': Data model 'Authentication' was not found.
01-04-2021 12:56:11.394 ERROR TsidxStats [3485 BatchSearch] - sid:etc.splunkcloud.com Datamodel 'Splunk_CIM_Validation.Authentication' had an invalid search, cannot get indexes to search

 

Update: I found some similar posts, where they mention this might be due to permission issue, but I have checked the permission for this DM and it is default to read for "Everyone". Other DMs with same permissions work well.

Also, when acceleration is disabled, it seems shows data in pivot

Can someone please help fix this ?

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

On new setup CIM Setup has macros for index whitelist as (*).

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @damode,

Splunk ES uses macros to define indexes on datamodels. The reason of the problem is Splunk_CIM_Validation app cannot use that macros and throws that errors. The only way I know is deeltng macros and put the index names into datamodel root searches. But you will loose adding/removing indexes to datamodel settings from CIM setup page.

If your need is checking CIM validation, I suggest you to use CIM-Validator app on Splunkbase. https://splunkbase.splunk.com/app/2968 

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

damode
Motivator

But this is newly setup Splunk ES on Splunk Cloud.

Could it be probably due to Indexes whitelist using all indexes in the "CIM setup" configuration of the ES app ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...