Splunk Enterprise Security

ES: DataModel Acceleration Enforcement: Encountered the following error while trying to update: The following required arguments are missing: manual_rebuilds.

maurizioCagliot
Engager

Hi,
when trying to remove the automatic data model acceleration enforcement from Data Inputs --> Data Model Acceleration Enforcement I'm receiving this error and I can't save:
Encountered the following error while trying to update: The following required arguments are missing: manual_rebuilds.

I'm logged as admin.

Any idea?
Thank you

garias_splunk
Splunk Employee
Splunk Employee

That is a known issue in ES 6.0 which is solved in 6.1 onwards. It is a UI problem.

 

There is a workaround for this using the command line rest point. For instance in order to disable the 'Web' DM Acceleration and Enforcement, run this:

curl -ku admin https://yourServerHere:8089/servicesNS/nobody/SplunkEnterpriseSecuritySuite/data/inputs/dm_accel_set... --data "acceleration=false&manual_rebuilds=false&output_mode=json" | python -m json.tool

b_chris21
Communicator

That worked in my case. Thank you very much Gaspar.

0 Karma

martinnepolean
Explorer

Any idea to fix  this issue?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...

Splunk Technical Support Is Moving to Cisco Support Tools

Introduction Splunk technical support is transitioning to Cisco’s support environment. This change brings ...