Hello All, I need your assistance to fetch the below details about Datamodels: - 1. What is the lifecycle of Splunk datamodel? 2. How Splunk logs events in _internal index when Splunk e...
When I pivot a particular datamodel, I get this error, "Datamodel 'Splunk_CIM_Validation.Vulnerabilities' had an invalid search, cannot get indexes to search" After inspecting the search.log, I n...
My Web Datamodel was set to 3 months with 67 GB+ size on disk. I reduced the summary range to 1 month, and size on disk increased to 100 GB+ size on disk. This doesn't make sense, can someone help e...
Hello,
Is there a way to validate the fields used in the datamodel by how compliant they are with the current setup?
I am trying to validate and fix data models to receive optimum results in t...
I have an accelerated CIM data model. The indexes used to populate the datamodel (and accelerated summaries) are defined by a macro (a typical CIM approach - cim_Email_indexes, c...
Hi, can someone one help me with an SPL so that I can list the indexes of a datamodel. datamodel name - authentication.malware Appreciate your help in advance.
Hi Splunk Team
I see this message on my entire datamodel, how can I fix it?
"This object has no explicit index constraint. Consider adding one for better performance."
How can fix it
Thanks
...roblem is, I cannot get anything to work related to GEOSTATS. Hopefully, I can lay this out in a simple manor..... Datamodel = test Extracted Fields: Client_IP (field within the log t...