Hi Splunkers, I have installed PCI in my Linux (rhel 6.3) environment and in the PCI app I do not see any data. I followed the steps in : https://docs.splunk.com/Documentation/PCI/3.7.2/Install/Assets#Format_asset_data_as_a_lookup I have a forwarder that is sending data to splunk. I am sending the last lines from splunkd.log 01-10-2019 11:30:32.371 -0500 WARN SearchEvaluatorBasedExpander - sid: Unable to find tag messaging 01-10-2019 11:30:32.767 -0500 WARN SearchEvaluatorBasedExpander - sid: Unable to find tag jvm 01-10-2019 11:30:32.902 -0500 WARN SearchEvaluatorBasedExpander - sid: Unable to find tag malware 01-10-2019 11:30:33.082 -0500 WARN SearchEvaluatorBasedExpander - sid: Unable to find tag malware 01-10-2019 11:30:33.082 -0500 WARN SearchEvaluatorBasedExpander - sid: Unable to find tag operations 01-10-2019 11:30:33.211 -0500 WARN SearchEvaluatorBasedExpander - sid: Unable to find tag resolution 01-10-2019 11:30:33.892 -0500 WARN SearchEvaluatorBasedExpander - sid: Unable to find tag facilities 01-10-2019 11:30:33.942 -0500 WARN SearchEvaluatorBasedExpander - sid: Eventtype 'gconfd_Linux_syslog' does not exist or is disabled. 01-10-2019 11:30:33.947 -0500 WARN SearchEvaluatorBasedExpander - sid: Eventtype 'gdm_Linux_general_syslog' does not exist or is disabled. 01-10-2019 11:30:33.953 -0500 WARN SearchEvaluatorBasedExpander - sid: Eventtype 'hpoid' does not exist or is disabled. 01-10-2019 11:30:33.961 -0500 WARN SearchEvaluatorBasedExpander - sid: Eventtype 'nix_agpart' does not exist or is disabled. 01-10-2019 11:30:33.966 -0500 WARN SearchEvaluatorBasedExpander - sid: Eventtype 'nix_configuration_change' does not exist or is disabled. 01-10-2019 11:30:33.975 -0500 WARN SearchEvaluatorBasedExpander - sid: Eventtype 'nix_kernel' does not exist or is disabled. 01-10-2019 11:30:33.989 -0500 WARN SearchEvaluatorBasedExpander - sid: Eventtype 'unix_runlevel_change' does not exist or is disabled. 01-10-2019 11:30:36.692 -0500 WARN SearchEvaluatorBasedExpander - sid: Unable to find tag ticketing 01-10-2019 11:30:37.703 -0500 WARN SearchEvaluatorBasedExpander - sid: Unable to find tag web 01-10-2019 11:30:38.484 -0500 ERROR DataModelCache - Invalid or unaccelerable root object for datamodel 01-10-2019 11:30:38.484 -0500 WARN ReadSummaryDirective - sid: Issue occurred with data model 'Splunk_Audit.Scheduler_Activity'. Issue: 'Failed to generate dmid' Reason: 'Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel'. 01-10-2019 11:30:38.484 -0500 WARN ReadSummaryDirective - sid: Failed to parse options. Clearing out read-summary arguments. 01-10-2019 11:30:38.672 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:38.674 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:38.842 -0500 ERROR DataModelCache - Invalid or unaccelerable root object for datamodel 01-10-2019 11:30:38.843 -0500 WARN ReadSummaryDirective - sid: Issue occurred with data model 'Splunk_Audit.Web_Service_Errors'. Issue: 'Failed to generate dmid' Reason: 'Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel'. 01-10-2019 11:30:38.843 -0500 WARN ReadSummaryDirective - sid: Failed to parse options. Clearing out read-summary arguments. 01-10-2019 11:30:39.169 -0500 ERROR DataModelCache - Invalid or unaccelerable root object for datamodel 01-10-2019 11:30:39.170 -0500 WARN ReadSummaryDirective - sid: Issue occurred with data model 'Malware.Malware_Operations'. Issue: 'Failed to generate dmid' Reason: 'Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel'. 01-10-2019 11:30:39.170 -0500 WARN ReadSummaryDirective - sid: Failed to parse options. Clearing out read-summary arguments. 01-10-2019 11:30:39.499 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:39.500 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:40.391 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:40.393 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:40.736 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:40.737 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:40.798 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:40.799 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:41.027 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:41.028 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:42.741 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:42.742 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:43.162 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:43.163 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:43.530 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:43.531 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:43.723 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:43.724 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:44.743 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:44.744 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:45.358 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:45.359 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:46.220 -0500 ERROR SearchOperator:filter - Error in 'where' command: The expression is malformed. An unexpected character is reached at '* AND hourDiff>) '. 01-10-2019 11:30:46.436 -0500 ERROR SearchOperator:rename - Error in 'rename' command: Usage: rename [old_name AS/TO/-> new_name]+. 01-10-2019 11:30:46.447 -0500 ERROR SearchOperator:rename - Error in 'rename' command: Usage: rename [old_name AS/TO/-> new_name]+. 01-10-2019 11:30:46.913 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:46.914 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:46.961 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:46.962 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:47.128 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:47.129 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:47.329 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:47.330 -0500 WARN LookupDataProvider - The value for timeformat '' is invalid. 01-10-2019 11:30:47.366 -0500 ERROR SearchParser - Missing a search command before ''. Error at position '2' of search query '| * | where isnotnull() | search * * * | sort +d'. 01-10-2019 11:30:47.501 -0500 ERROR SearchOperator:filter - Error in 'where' command: The expression is malformed. An unexpected character is reached at ' '. 01-10-2019 11:30:47.778 -0500 ERROR TsidxStats - Wildcards () are not supported in aggregate fields 01-10-2019 11:30:47.786 -0500 ERROR TsidxStats - Wildcards () are not supported in aggregate fields 01-10-2019 11:38:13.756 -0500 INFO ClientSessionsManager:Listener_AppEvents - Received count=1 AppEvent from DC ip=192.168.204.1 name=AEC625E5-FB82-4AD0-B10F-35CCADACD4CF ... View more