Splunk Search

Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel

nareshinsvu
Builder

Hi Champs,

I am getting below error when I run below tstats command. My datamodel is just a search query with multiple rex, evals and transaction commands - saved as a Datamodel/Table

|tstats count from datamodel=0_WebPay_Dataset

Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel

How can I fix this without creating a new Datamodel with a Dataset having a root object? - This makes my effort complex.

Tags (1)
0 Karma

DavidHourani
Super Champion

Hi @nareshinsvu,

seems like you're hitting something similar to this :
https://answers.splunk.com/answers/279032/searching-from-a-data-model-using-tstats-why-am-i.html

You'll need to define a root event as shown here :
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Designdatamodelobjects#Add_a_root_even...

And then accelerate the DM to make sure you can run the search on your summary data.

0 Karma

nareshinsvu
Builder

My datamodel is of type "table" But not a "data model". That's the reason, I am not able to add a new dataset (of root event) to this datamodel. And hence not able to accelarate as it is having a combination of rex,evals and transaction commands which might be streaming in my case (Im not sure)

How can I define a root event on my existing datamodel which is a table and get tstats working?

0 Karma

nareshinsvu
Builder

Need help from tstats experts please.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...