Splunk Search

Why is there Circular dependency Issue in Data Model?

kashz
Explorer

Error: Error in 'SearchProcessor': Found circular dependency when expanding from.Network_Traffic.All_Traffic

Background: core is an index containing {ipAddress, score}.

When creating a data model with the following query:
`| union
[| from datamodel:"Network_Traffic.All_Traffic" | join type=left src_ip [search source=core | rename ipAddress AS src_ip] | rename src_ip as ip | stats latest(score) by ip | where score!="" and score!="null"]

[| from datamodel:"Network_Traffic.All_Traffic" | join type=left dest_ip [search source=core | rename ipAddress AS dest_ip] | rename dest_ip as ip | stats latest(score) by ip | where score!="" and score!="null"]`

I'm trying to lookup all ipAddress from the NetworkTraffic datamodel and map it with score from the core index.

0 Karma

jordan
Loves-to-Learn

Tyr to use tstats and not "from datamodel" , also the  "Circular dependency Issue" could happened if it encounters missing tsidx data.

try using tstats with summariesonly=false

 

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...