Splunk Search

Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel

nareshinsvu
Builder

Hi Champs,

I am getting below error when I run below tstats command. My datamodel is just a search query with multiple rex, evals and transaction commands - saved as a Datamodel/Table

|tstats count from datamodel=0_WebPay_Dataset

Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel

How can I fix this without creating a new Datamodel with a Dataset having a root object? - This makes my effort complex.

Tags (1)
0 Karma

DavidHourani
Super Champion

Hi @nareshinsvu,

seems like you're hitting something similar to this :
https://answers.splunk.com/answers/279032/searching-from-a-data-model-using-tstats-why-am-i.html

You'll need to define a root event as shown here :
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Designdatamodelobjects#Add_a_root_even...

And then accelerate the DM to make sure you can run the search on your summary data.

0 Karma

nareshinsvu
Builder

My datamodel is of type "table" But not a "data model". That's the reason, I am not able to add a new dataset (of root event) to this datamodel. And hence not able to accelarate as it is having a combination of rex,evals and transaction commands which might be streaming in my case (Im not sure)

How can I define a root event on my existing datamodel which is a table and get tstats working?

0 Karma

nareshinsvu
Builder

Need help from tstats experts please.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...