Hi all,
I want to configure a Datamodel in different apps. On app should define the datamodel (here search). The seconds app should (here: dm_acc) should define schedule and acceleration.
andreas@art-mb-2.local:~/splunk/etc/apps$ cat search/metadata/local.meta
[datamodels/metricbeat]
access = read : [ * ], write : [ admin ]
owner = testuser
[models/metricbeat]
access = read : [ * ], write : [ admin ]
owner = testuser
andreas@art-mb-2.local:~/splunk/etc/apps$ cat search/local/datamodels.conf
[metricbeat]
#acceleration = true
#acceleration.earliest_time = 0
acceleration.hunk.dfs_block_size = 0
andreas@art-mb-2.local:~/splunk/etc/apps/dm_acc$ cat default/datamodels.conf
[metricbeat]
acceleration = true
acceleration.earliest_time = 0
acceleration.cron_schedule = * * * * *
andreas@art-mb-2.local:~/splunk/etc/apps/dm_acc$ cat metadata/local.meta
[]
access = read : [ * ], write : [ admin ]
export = system
this seems to work fine so far. I can query the DM using
| tstats summariesonly=t count values(host) from datamodel=metricbeat
Unfurtunaly I'm receiving an error message: "Error in data model "metricbeat" : JSON file contents not available." when using the WebGUI and access Datamodels.
Any hint's?! Does this look like a GUI bug?!
Regards,
Andreas
↧