Currently the query you use is:
| rest /services/data/models | search acceleration=1 | fields title, eai:acl.app | eval app_model_name='eai:acl.app' . " / " . title | eval dm_full_name="DM_" . 'eai:acl.app' . "_" . title
On my Splunk 6.4.0 instance that gets no results, in fact :
| rest /services/data/models
Shows me 12 data models, all within the search application (I am running from the fire brigade application FYI).
However, if you do:
|rest servicesNS/-/-/data/models | search acceleration=1 | fields title, eai:acl.app | eval app_model_name='eai:acl.app' . " / " . title | eval dm_full_name="DM_" . 'eai:acl.app' . "_" . title
I get the expected result, a number of data models which are accelerated, including those provided by the nmon application.
The query:
|rest servicesNS/-/-/data/models
Was provided by Splunk support while during investigating why the REST query would not return all the data models as expected.
Can you update the application please?
Also if you find this useful please vote...
Thanks
↧