Splunk Enterprise

Why does the second data set in my data models not produce results?

thisissplunk
Builder

I have been pulling my hair out on this one all day.

I have an accelerated data model that has two data sets:

  • hostInfo
  • networkInfo

They are stand alone root searches. They do happen to share some fields like hostname. When running the searches in a normal splunk search window work perfectly fine. Example:

 

 

 

index=summary_host_info search_name="Host_Info" | fields hostname os cpu

 

 

 

However, only the first data set ever returns results from tstats. I've tested and swapped the two around.

Example of a simple query I've been using to test:

 

 

 

| tstats count("hostInfo.hostname") FROM datamodel="endpoint_info" WHERE nodename="hostInfo"

 

 

 

 There are no required fields, permissions seem fine and the data model summary is 10% built at around 1gb. I can even recreate the same data set and use that as the second one and that second identical data set will not return results.

 

Edit: I finally found a warning after clicking on "Datasets" at the top and clicking into one specifically:

 

    Issue occurred with data model 'test.s3jaytest'. Issue: 'Failed to generate dmid' Reason: 'Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel'.
    Failed to parse options. Clearing out read-summary arguments.

 

What does this mean and how do I fix it? I'm using root searches, not root events.

 

Labels (2)
0 Karma
1 Solution

thisissplunk
Builder

We didn't find a solution for this, or a reason why two root searches in one data model doesn't work. Our workaround was to make one root search data set per model.

This had the positive side effect of making the smaller data set 100x faster than when it was combined as a child with the other data set.

View solution in original post

0 Karma

thisissplunk
Builder

We didn't find a solution for this, or a reason why two root searches in one data model doesn't work. Our workaround was to make one root search data set per model.

This had the positive side effect of making the smaller data set 100x faster than when it was combined as a child with the other data set.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...