Troubleshoot data model queries
AI summary
About AI summaries.
This topic helps you diagnose queries that use data models and return zero results or inconsistent results.
Several causes depend on the form in which Splunk sends the query to Lumi: a data model query or an expanded search. To determine which form applies to your query, see the query form table in Data model acceleration.
Zero results
Most problems with queries that use data models surface the same way: zero results and no error. When a query against a data model returns nothing, check the following in order. Each cause states which query form it applies to.
Field doesn't exist in Lumi
Applies to: Expanded searches.
Expanded searches don't use the IAM key mapping: whatever field name appears in the query must exist on your Lumi events with that exact name. The mapping translates field names only for data model queries.
For example, suppose your events have a method field and your IAM key maps the data model field http_method to it.
A Pivot filter on http_method works on an accelerated data model, because Lumi translates http_method to method through the mapping.
The same filter on a non-accelerated data model is sent as an expanded search that filters on http_method literally, and because your events have no field with that name, it finds no matches.
To check whether a field exists on your events, run index=<index> | stats count by <field> in Lumi.
If the field doesn't exist, this returns no results.
Time range excludes events
Applies to: Both query forms.
Check the query time range against your event timestamps, and confirm the range returns the same events in Splunk and Lumi. To compare, run the same time-bounded search in both and check the event counts match.
Field isn't in IAM key mapping
Applies to: Data model queries.
For data model queries, Lumi resolves fields only through the data model attribute. Filtering or grouping by an unmapped field returns zero results, not an error. Check that every field in your query appears in the mapping.
Incorrect field name quoting
Applies to: Both query forms.
Data model field names contain dots and need single quotes in where and eval, but must be bare in BY clauses and fields lists.
Incorrect quoting in either direction returns zero results, not an error.
See Commands that follow a data model clause for details.
Query is out of scope
Applies to: Expanded searches.
Expanded searches must satisfy the allowed indexes conditions. If they don't, Lumi rejects the query and returns empty results.
Data model constraint can't match Lumi events
Applies to: Expanded searches.
Constraints that rely on tags or event types, such as the CIM Web data model's tag=web, are inlined into expanded searches and typically can't match Lumi events.
To fix this, rewrite the constraint to use fields that exist on your Lumi events, such as an index and sourcetype. Alternatively, accelerate the data model so that Splunk sends Pivot queries as data model queries, which don't inline the constraint.
Inconsistent results
If the same report or search returns different results in different circumstances, check the following.
Report returns different results depending on acceleration
Splunk sends a Pivot report to Lumi in one of two forms depending on acceleration: as a data model query (accelerated) or as an expanded search (non-accelerated). Different definitions apply to each form. A data model query resolves fields through the IAM key data model attribute, while an expanded search uses the Splunk data model definition inlined into the search, so the same report can produce different results. See Data model acceleration for details of the two forms.
To keep results consistent, map each data model field to a Lumi field that contains the same values the Splunk definition produces.
Multiple federated provider modes
Don't enable both standard and transparent federated providers that point to the same Lumi endpoint, because it can cause inconsistent results.
Each federated provider's behavior is determined by the IAM key it uses. When two providers use different IAM keys, the same query can be checked against different allowed indexes settings and resolve fields through different data model attributes, depending on which provider handles it. This applies regardless of whether the provider is configured as standard or transparent mode in Splunk.
Learn more
See the following topics for more information:
- Query Lumi events with data models for an overview of how Lumi resolves data model queries.
- Configure Lumi for data model queries to set up the IAM key data model attribute and field mappings.
- Set up transparent federated search for transparent federated search setup instructions.