Splunk Enterprise Security

Datamodel Child object not accelerated

Path Finder

We created a child object within the authentication datamodel.
The authentication datamodel is accelerated, when searching the data using summariesonly=t we get data from the root and other childs but not from the child that we created. If we do not use summariesonly=t then we do see data.

As a test i cloned the entire authentication datamodel and accelerated it and then i am able to use summariesonly=t.

What we have tried:
- Rebuild the original authentication datamodel
- Clone the datamodel (works)
- Remove the child object and add it again.

The search we are using:

| tstats summariesonly=t count from datamodel=Authentication_test where nodename=Authentication.Login_Interactive

The only difference i can find is that the original datamodel is in Splunk_SA_CIM and the cloned datamodel is in SplunkEnterpriseSecuritySuite. If anyone has an idea how to get the child element accelerated in the original authentication model i would be a happy splunker.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...