All Apps and Add-ons

How to solve the Accelerated Data Model Search Problem in Splunk Common Information Model (CIM)?

MikeElliott
Communicator

Hi Team,

I have recently mapped new sourcetypes to the Web data model, however, when searching using tstats, none of the new sourcetypes are returned in the search results.

When I run the below search, I can see that data from my websense, squid and bluecoat proxies are present in the data model

| datamodel Web Web search | search * | stats count by index, sourcetype | sort -count

However, when attempting to search the data model using tstats, only websense and squid show up in the search results.

| tstats summariesonly=t prestats=f count from datamodel=Web.Web WHERE sourcetype=* BY sourcetype Web.src Web.site Web.dest Web.url | dedup sourcetype

Does anyone have any ideas what has gone wrong?

aamer86
Path Finder

I had this issue

A data model names Web that includes my WAF source type
I created another DM named after my WAF, this caused my WAF not to show in the results as a sourcetype when querying the Web DM

So i removed the created DM and it worked again

0 Karma

p_gurav
Champion

is the acceleration completed? and if your are doing by sourcetype why sourcetype=*, is sourcetype field has null values?

0 Karma

MikeElliott
Communicator

can confirm, data model acceleration is at 100%. sourcetype=* was chosen as sourcetype=bluecoat wasn't working and wanted to see if any of the other sourcetypes were present in the search results.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...