Splunk Enterprise Security

ES: DataModel Acceleration Enforcement: Encountered the following error while trying to update: The following required arguments are missing: manual_rebuilds.

maurizioCagliot
Engager

Hi,
when trying to remove the automatic data model acceleration enforcement from Data Inputs --> Data Model Acceleration Enforcement I'm receiving this error and I can't save:
Encountered the following error while trying to update: The following required arguments are missing: manual_rebuilds.

I'm logged as admin.

Any idea?
Thank you

garias_splunk
Splunk Employee
Splunk Employee

That is a known issue in ES 6.0 which is solved in 6.1 onwards. It is a UI problem.

 

There is a workaround for this using the command line rest point. For instance in order to disable the 'Web' DM Acceleration and Enforcement, run this:

curl -ku admin https://yourServerHere:8089/servicesNS/nobody/SplunkEnterpriseSecuritySuite/data/inputs/dm_accel_set... --data "acceleration=false&manual_rebuilds=false&output_mode=json" | python -m json.tool

b_chris21
Communicator

That worked in my case. Thank you very much Gaspar.

0 Karma

martinnepolean
Explorer

Any idea to fix  this issue?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...