Hi
We've setup the Data Model Wrangler App in our on-prem Search Head. We're running Splunk Core 9.0.3 and ES 7.0.1
The latest SA-cim-validator and CIM App are installed as per the installation notes. These apps are working as expected showing results from the validator app.
I created an index from the Splunk WebUI visible under the DM Wrangler App called data_model_wrangler.
We've scheduled the 3 saved searches that come with the App as per the instructions.
We only see results out of 1 from the 3 saved searches from the DM Wrangler App. Also the index created is empty.
This being
data_model_wrangler_dm_index_sourcetype_field
The two other saved searches are:
data_model_wrangler_field_quality
data_model_wrangler_mapping_quality
No results to summary index.
All saved searches and indexes are enabled.
Can anyone please suggest where we've gone wrong in setting this up?
Thanks in advance
Hi @slider8p2023,
did you customized the three macros that are present in this app to populate the lookups?
they are:
Put attention especially to the first that contains the list of indexer to check.
Ciao.
Giuseppe
Hi @gcusello
I checked the macros again and they contain the same values you listed earlier.
Unless we've missed something, very basic they look in order. I've attached the screenshots of the macro configs.
I believe they are correct? They were all self populated when the App was installed. There are no details about special settings for the index which I created via the WebUI with the suggested default index name.
Thanks again