Palo Alto Networks App: failed to manually move data models in Splunk Enterprise

[jessemo]

I want to manually move the data models "pan_firewall" i downloaded to the Search&Reporting in splunk enterprise.

i put the pan_firewall.json file into C:\Program Files\Splunk\etc\apps\search\default\data\models and i also moved the stanza in datamodels.conf and metadata in local.meta and default meta. i am able to search and display the datamodel by command |datamodel in the search bar but i could not search by | from datamodel:"pan_firewall" and it said Data model 'pan_firewall' was not found.

i am confused. Do i need to also move the stanza of other files such as event types, inputs, props etc, the files related to the data models to the search folder?

[jbrocks]

If you are searching in Splunk Enterprise Security, your data model needs to be accelerated to be used in Splunk ES. After activating acceleration for yout data model, it may take a few minutes to work, because Splunk ES runs crons (mostly about every 5 minutes) to look for data model. You can get more information in Splunk ES under > Audit > Data Model Audit. Hope this helps!