Splunk Enterprise

Why does the second data set in my data models not produce results?

thisissplunk
Builder

I have been pulling my hair out on this one all day.

I have an accelerated data model that has two data sets:

  • hostInfo
  • networkInfo

They are stand alone root searches. They do happen to share some fields like hostname. When running the searches in a normal splunk search window work perfectly fine. Example:

 

 

 

index=summary_host_info search_name="Host_Info" | fields hostname os cpu

 

 

 

However, only the first data set ever returns results from tstats. I've tested and swapped the two around.

Example of a simple query I've been using to test:

 

 

 

| tstats count("hostInfo.hostname") FROM datamodel="endpoint_info" WHERE nodename="hostInfo"

 

 

 

 There are no required fields, permissions seem fine and the data model summary is 10% built at around 1gb. I can even recreate the same data set and use that as the second one and that second identical data set will not return results.

 

Edit: I finally found a warning after clicking on "Datasets" at the top and clicking into one specifically:

 

    Issue occurred with data model 'test.s3jaytest'. Issue: 'Failed to generate dmid' Reason: 'Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel'.
    Failed to parse options. Clearing out read-summary arguments.

 

What does this mean and how do I fix it? I'm using root searches, not root events.

 

Labels (2)
0 Karma
1 Solution

thisissplunk
Builder

We didn't find a solution for this, or a reason why two root searches in one data model doesn't work. Our workaround was to make one root search data set per model.

This had the positive side effect of making the smaller data set 100x faster than when it was combined as a child with the other data set.

View solution in original post

0 Karma

thisissplunk
Builder

We didn't find a solution for this, or a reason why two root searches in one data model doesn't work. Our workaround was to make one root search data set per model.

This had the positive side effect of making the smaller data set 100x faster than when it was combined as a child with the other data set.

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...