Trying to install and app into Splunk 6.4.3 and getting Datamodles issues

[robertlynch2020]

Hi

I have developed and a app in 7.0.3 and we are testing it to import into Splunk 6.4.3.
I have multiple dashboards with multiple Datamodles, However i am getting an strange errors from the Datamodles. It is telling me for example the field "memory" all ready exists in another datamodel. This me this is very strange and i don't link the Datamodles. They are all separate. Why would impact another + when i was creating them this was not an issue?

Error in model "MXTIMING_RATE_CURVE" : Cannot add field 'Context' because it already exists in object 'MXTIMING'.
Error in model "MXTIMING_RATE_CURVE_Status_Y" : Cannot add field 'Context' because it already exists in object 'MXTIMING'.
Error in model "MXTIMING_V8" : Cannot add field 'Memory' because it already exists in object 'MXTIMING'.
Error in model "MXTIMING_V8_5_Seconds" : Cannot add field 'Memory' because it already exists in object 'MXTIMING'.
Error in model "QCST" : Cannot add field 'ActivityType' because it already exists in object 'qcst'.
Error in model "QCST_BETA" : Cannot add field 'ActivityType' because it already exists in object 'qcst'.

[robertlynch2020 · Accepted solution]

Hi

In The end was a version issues, in the later version you can overwrite a field "context" in CALCULATED, but in the earler version you cant. So i had to change the name of "context" to "context2" in the CALCULATED and it worked -

Thanks For your help on this
Robert

[jkat54]

Its not that ANOTHER data model exists its another OBJECT in the SAME data model with the SAME field extraction already exists.

If you look at this sample data model that comes with splunk:

The "OBJECTS" i speak of are on the left side... "Audit" is a root event search, and the searches below it make use of every extraction that has come before it. So if i extract a field called JKAT54 in the Audit root event search, then I cant extract it again in the Searches child event search.

Make sense?

[robertlynch2020]

Cheers - This is perfect.

[robertlynch2020]

Hi

![alt text][1]I cant import on the old version, but i can on Splunk 7.0.2. Without issue.

So now i need a workaround, as i need to get this into the app.

C:\Users\rlynch\Desktop\Quick_Work\Greenhorn\2018-05-15+15_53_13-Edit+Objects_+MXTIMING1_RATE_CURVE_CLONE_TOBE_DELETED+_+Splunk+7.1.0.png

[jkat54]

Try “downloading” or “exporting the data model and look at the json... See if you can find the duplicate that way.

[robertlynch2020]

Hi

In The end was a version issues, in the later version you can overwrite a field "context" in CALCULATED, but in the earler version you cant. So i had to change the name of "context" to "context2" in the CALCULATED and it worked -

Thanks For your help on this
Robert