Reporting

Deleted datamodel does not disappear from datamodel

christopherwern
New Member

Hello experts,

I deleted a datamodel via splunk GUI but sadly it is still appearing in the list of datamodels.
Furthermore the GUI displays the following error:
Error in model "NamedModel" : JSON file contents not available.

I can not access the model any longer and if I delete it again via GUI, the data model gets removed from the list of models.
Unfortunately the datamodel is back in the list after a refresh of the datamodels page.

Any clue how I can solve that issue?

Kind regards and thanks in advance,
Christopher

0 Karma

andygerber
Path Finder

Look at your .conf files for where the data model is referenced, delete the reference in the file, do a debug refresh.

0 Karma

mayurr98
Super Champion

hey try deleting data model manually using CLI

http://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Managedatamodels#Delete_a_data_model

Also, try debug/refresh Or try restarting Splunk instance

Let me know if it helps!

0 Karma

christopherwern
New Member

hello,

thank you for your quick reply!
I am not able to restart the splunk instance because we are running a search head cluster.

0 Karma

mayurr98
Super Champion

You can do rolling restart on sh cluster using splunk rolling-restart shcluster-members

Pls refer this link for more:
https://docs.splunk.com/Documentation/Splunk/7.0.1/DistSearch/RestartSHC

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...