Splunk Enterprise Security

ES: DataModel Acceleration Enforcement: Encountered the following error while trying to update: The following required arguments are missing: manual_rebuilds.

maurizioCagliot
Engager

Hi,
when trying to remove the automatic data model acceleration enforcement from Data Inputs --> Data Model Acceleration Enforcement I'm receiving this error and I can't save:
Encountered the following error while trying to update: The following required arguments are missing: manual_rebuilds.

I'm logged as admin.

Any idea?
Thank you

garias_splunk
Splunk Employee
Splunk Employee

That is a known issue in ES 6.0 which is solved in 6.1 onwards. It is a UI problem.

 

There is a workaround for this using the command line rest point. For instance in order to disable the 'Web' DM Acceleration and Enforcement, run this:

curl -ku admin https://yourServerHere:8089/servicesNS/nobody/SplunkEnterpriseSecuritySuite/data/inputs/dm_accel_set... --data "acceleration=false&manual_rebuilds=false&output_mode=json" | python -m json.tool

b_chris21
Communicator

That worked in my case. Thank you very much Gaspar.

0 Karma

martinnepolean
Explorer

Any idea to fix  this issue?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Introducing the 2026 - 2027 SplunkTrust cohort!

The goal of the SplunkTrust™ membership has historically been to acknowledge and recognize those who go above ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...