Splunk Enterprise Security

Error in 'DataModelCache': Could not create search for invalid datamodel: Identity_Management

damode
Motivator

Pivot for Assets and Identities Data model -"Identity_Management" showing zero count.

When running search - |tstats count from datamodel=Identity_Management by index

 

Error in 'DataModelCache': Could not create search for invalid datamodel: Identity_Management
The search job has failed due to an error. You may be able view the job in the Job Inspector.

 

12-14-2020 05:50:01.195 ERROR DataModelCache [33401 searchOrchestrator] - Could not create search for invalid datamodel: Identity_Management
12-14-2020 05:50:01.195 ERROR SearchPhaseGenerator [33401 searchOrchestrator] - Fallback to two phase search failed:Error in 'DataModelCache': Could not create search for invalid datamodel: Identity_Management
12-14-2020 05:50:01.195 ERROR SearchOrchestrator [33401 searchOrchestrator] - Error in 'DataModelCache': Could not create search for invalid datamodel: Identity_Management
12-14-2020 05:50:01.195 ERROR SearchStatusEnforcer [33401 searchOrchestrator] - sid:1607925000.24084 Error in 'DataModelCache': Could not create search for invalid datamodel: Identity_Management

 

Pleasse advise! Thanks!

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...