Splunk Enterprise Security

Splunk Enterprise Security: Why am I getting "[indexer] The search for datamodel 'Threat_Intelligence' failed to parse, cannot get indexes to search"?

Afef
Communicator

Hello,

I have an error message in the threat activity dashboard in a Splunk Entreprise Security search head:

[indexer] The search for datamodel 'Threat_Intelligence' failed to parse, cannot get indexes to search !

I disabled acceleration in the threat intelligence data model and I still have the error.

Any help please?

0 Karma

rickylee
New Member

I just had this issue resolved. Check to see if your indexers are running the same version of splunk as your ES search head. They should be identical. Also make sure to deploy the Splunk_TA_ForIndexers from your ES search head to your indexers.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

What is the baseline search for you "Threat_Intelligence" data model? Have you configured it to search specific indexes or changed the root constraints of the DM? Additionally what version of CIM and ES?

0 Karma

Afef
Communicator

hi, i didn't change any thing.. CIM and ES latest versions.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...