×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
armandof
Explorer
Member since: ‎03-23-2023
‎11-01-2023
Community Statistics
Posts 3
Solutions 1
Karma Given 0
Karma Received 3
Member Since ‎03-23-2023
View All

Re: Getting an error when sharing Data Model summa...

by in Splunk Enterprise
‎11-01-2023 10:21 AM
1 Karma
‎11-01-2023 10:21 AM
1 Karma
I had to look through the search job logs where I noticed there were some errors regarding a lookup that didn't exist in that SH but was being used by the SH running the DM acceleration. I added said lookup and fields to all SHs where I was sharing DMA summaries and the error went away. I'd start by reviewing search job logs and then going over your affected DM(s) to see if there are any lookups being used to populate any fields. ... View more

Re: Getting an error when sharing Data Model summa...

by in Splunk Enterprise
‎03-24-2023 08:13 AM
1 Karma
‎03-24-2023 08:13 AM
1 Karma
Figured it out by looking at search job logs. Looks like the SH that is using the source GUID is parsing out the search using all if it's local knowledge objects. At some point the name of a lookup definition was changed and never updated on this SH's local DM JSON since it wasn't going to be the one generating the summaries. I updated the name of the lookup in the JSON and all is well now.  ... View more

Getting an error when sharing Data Model summaries...

by in Splunk Enterprise
‎03-23-2023 01:05 PM
1 Karma
‎03-23-2023 01:05 PM
1 Karma
I had been sharing DM summaries successfully between a pair of standalone SHs. However, I started getting the error below for one of the DM summaries being shared. Other DM summaries don't appear to have this same issue. Nothing in datamodels.conf has changed and the source SH still has the same GUID. Anyone else run into this issue? Running 9.0.4 on all instances in this deployment. Summaries for the data model at the specified source GUID XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX do not exist. Verify that it is accelerated. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎11-01-2023 02:47 PM
Karma from
View All