Splunk Enterprise Security

Splunk App for Enterprise Security: Network Resolution Data Model not building

shaung
Engager

The only error I can find which seems relevant is this:

06-12-2015 11:21:59.013 -0600 INFO  SavedSplunker - savedsearch_id="nobody;Splunk_SA_CIM;_ACCELERATE_DM_Splunk_SA_CIM_Network_Resolution_ACCELERATE_", user="nobody", app="Splunk_SA_CIM", savedsearch_name="_ACCELERATE_DM_Splunk_SA_CIM_Network_Resolution_ACCELERATE_", status=skipped, reason="maxAutosummary limit reached", scheduled_time=1434129420

However, I cannot find any details on maxAutoSummary limited reached.

aholzel
Communicator

I know it is a bit late but for those that have the same problem and land on this page (like myself):
The problem setting is "auto_summary_perc" in limits.conf
From docs:

auto_summary_perc = <integer>
* The maximum number of concurrent searches to be allocated for auto
  summarization, as a percentage of the concurrent searches that the scheduler
  can run.
* Auto summary searches include:
  * Searches which generate the data for the Report Acceleration feature.
  * Searches which generate the data for Data Model acceleration.
* Note: user scheduled searches take precedence over auto summary searches.
* Defaults to 50.

mdessus_splunk
Splunk Employee
Splunk Employee

Is there any information in the ES datamodel audit dashboard ?
Does all other datamodel are working well ?
What are your hardware spec and your volume of data indexed per day ?

0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...