Why need index when create dataset in Datamodel in Splunk 7.3

[longnh26]

Now i using Splunk 7.3 and creating datamodel with search sourcetype but it's false ??
I try with splunk 7.2 and lower then Ok.

Please tell me why? and how to fix it?

[broberg]

You should always have a index specified in the datamodel even if its index=* so if you don't have any index anywere, that error seems to be correct.

[longnh26]

because this index have many other data, then i think if use only sourcetype to increase performance.

[gfreitas]

Maybe if you add index=* it works?

[longnh26]

Yes, it's work. But this index have many other data, then i think if use only sourcetype to increase performance.

[ivanreis · Accepted solution]

All the data ingested at Splunk have to be assigned to an index. Check if the index you are using on version 7.2 is the setup as default at Splunk role assigned to the user you are creating the datamodel. It is possible the index is setup as default for searching.
See below how you can check:
Please navigate to Splunk menu and select:

Settings/Roles and edit the particular role, and check if the index is setup as a default under Indexes tab. If so, then run the same procedure to version 7.3. If the index is not created or assigned to default, then create and setup the configuration.
The best practice is to specify the indexes when you are creating the reports/dashboards/datamodels, etc... to avoid performance issues when running on large environments. So my suggestion is to always use the index to identify your data.
E.g:

index=stream sourcetype=stream:http