All Apps and Add-ons

Palo Alto Networks App: failed to manually move data models in Splunk Enterprise

jessemo
New Member

I want to manually move the data models "pan_firewall" i downloaded to the Search&Reporting in splunk enterprise.

i put the pan_firewall.json file into C:\Program Files\Splunk\etc\apps\search\default\data\models and i also moved the stanza in datamodels.conf and metadata in local.meta and default meta. i am able to search and display the datamodel by command |datamodel in the search bar but i could not search by | from datamodel:"pan_firewall" and it said Data model 'pan_firewall' was not found.

i am confused. Do i need to also move the stanza of other files such as event types, inputs, props etc, the files related to the data models to the search folder?

0 Karma

jbrocks
Communicator

If you are searching in Splunk Enterprise Security, your data model needs to be accelerated to be used in Splunk ES. After activating acceleration for yout data model, it may take a few minutes to work, because Splunk ES runs crons (mostly about every 5 minutes) to look for data model. You can get more information in Splunk ES under > Audit > Data Model Audit. Hope this helps!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...