Splunk Enterprise Security

Error in 'DataModelCache': Could not create search for invalid datamodel: Identity_Management

damode
Motivator

Pivot for Assets and Identities Data model -"Identity_Management" showing zero count.

When running search - |tstats count from datamodel=Identity_Management by index

 

Error in 'DataModelCache': Could not create search for invalid datamodel: Identity_Management
The search job has failed due to an error. You may be able view the job in the Job Inspector.

 

12-14-2020 05:50:01.195 ERROR DataModelCache [33401 searchOrchestrator] - Could not create search for invalid datamodel: Identity_Management
12-14-2020 05:50:01.195 ERROR SearchPhaseGenerator [33401 searchOrchestrator] - Fallback to two phase search failed:Error in 'DataModelCache': Could not create search for invalid datamodel: Identity_Management
12-14-2020 05:50:01.195 ERROR SearchOrchestrator [33401 searchOrchestrator] - Error in 'DataModelCache': Could not create search for invalid datamodel: Identity_Management
12-14-2020 05:50:01.195 ERROR SearchStatusEnforcer [33401 searchOrchestrator] - sid:1607925000.24084 Error in 'DataModelCache': Could not create search for invalid datamodel: Identity_Management

 

Pleasse advise! Thanks!

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...