Accelerating CIM Validation (S.o.S.) datamodel results in error

[damode]

After accelerating the CIM Validation (S.o.S.) DM and upon checking the pivot for any of the datasets results in an error. Example below:

Datamodel 'Splunk_CIM_Validation.Authentication' had an invalid search, cannot get indexes to search

 Upon checking the search.log, it states

ERROR DataModelEvaluator [3485 BatchSearch] - Data model 'Authentication' was not found.
01-04-2021 12:56:11.393 ERROR SearchOperator:datamodel [3485 BatchSearch] - Error in 'DataModelEvaluator': Data model 'Authentication' was not found.
01-04-2021 12:56:11.394 ERROR TsidxStats [3485 BatchSearch] - Error in 'SearchOperator:datamodel': Error in 'DataModelEvaluator': Data model 'Authentication' was not found.
01-04-2021 12:56:11.394 ERROR TsidxStats [3485 BatchSearch] - sid:etc.splunkcloud.com Datamodel 'Splunk_CIM_Validation.Authentication' had an invalid search, cannot get indexes to search

Update: I found some similar posts, where they mention this might be due to permission issue, but I have checked the permission for this DM and it is default to read for "Everyone". Other DMs with same permissions work well.

Also, when acceleration is disabled, it seems shows data in pivot

Can someone please help fix this ?

[scelikok]

On new setup CIM Setup has macros for index whitelist as (*).

[scelikok]

Hi @damode,

Splunk ES uses macros to define indexes on datamodels. The reason of the problem is Splunk_CIM_Validation app cannot use that macros and throws that errors. The only way I know is deeltng macros and put the index names into datamodel root searches. But you will loose adding/removing indexes to datamodel settings from CIM setup page.

If your need is checking CIM validation, I suggest you to use CIM-Validator app on Splunkbase. https://splunkbase.splunk.com/app/2968 

If this reply helps you an upvote is appreciated.

[damode]

But this is newly setup Splunk ES on Splunk Cloud.

Could it be probably due to Indexes whitelist using all indexes in the "CIM setup" configuration of the ES app ?