Splunk Enterprise

Why does the second data set in my data models not produce results?

thisissplunk
Builder

I have been pulling my hair out on this one all day.

I have an accelerated data model that has two data sets:

  • hostInfo
  • networkInfo

They are stand alone root searches. They do happen to share some fields like hostname. When running the searches in a normal splunk search window work perfectly fine. Example:

 

 

 

index=summary_host_info search_name="Host_Info" | fields hostname os cpu

 

 

 

However, only the first data set ever returns results from tstats. I've tested and swapped the two around.

Example of a simple query I've been using to test:

 

 

 

| tstats count("hostInfo.hostname") FROM datamodel="endpoint_info" WHERE nodename="hostInfo"

 

 

 

 There are no required fields, permissions seem fine and the data model summary is 10% built at around 1gb. I can even recreate the same data set and use that as the second one and that second identical data set will not return results.

 

Edit: I finally found a warning after clicking on "Datasets" at the top and clicking into one specifically:

 

    Issue occurred with data model 'test.s3jaytest'. Issue: 'Failed to generate dmid' Reason: 'Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel'.
    Failed to parse options. Clearing out read-summary arguments.

 

What does this mean and how do I fix it? I'm using root searches, not root events.

 

Labels (2)
0 Karma
1 Solution

thisissplunk
Builder

We didn't find a solution for this, or a reason why two root searches in one data model doesn't work. Our workaround was to make one root search data set per model.

This had the positive side effect of making the smaller data set 100x faster than when it was combined as a child with the other data set.

View solution in original post

0 Karma

thisissplunk
Builder

We didn't find a solution for this, or a reason why two root searches in one data model doesn't work. Our workaround was to make one root search data set per model.

This had the positive side effect of making the smaller data set 100x faster than when it was combined as a child with the other data set.

0 Karma
Get Updates on the Splunk Community!

Is there an add-on for the Cisco Meraki devices?

We have many Cisco Meraki devices sending data via syslog to Splunk. Is there an add-on for ...

Should our Deployment Servers have the Search Head server role on them?

all of our stuff is on premcurrently our dedicated Deployment Servers also have the Search Head role on them, ...

Why am I unable to create dropdown static option that is "All" static options ...

Hi, I am trying to get a static option that is "All" the individual static options combined.  The mCode ...