I want to manually move the data models "pan_firewall" i downloaded to the Search&Reporting in splunk enterprise.
i put the panfirewall.json file into C:\Program Files\Splunk\etc\apps\search\default\data\models and i also moved the stanza in datamodels.conf and metadata in local.meta and default meta. i am able to search and display the datamodel by command |datamodel in the search bar but i could not search by | from datamodel:"panfirewall" and it said Data model 'pan_firewall' was not found.
i am confused. Do i need to also move the stanza of other files such as event types, inputs, props etc, the files related to the data models to the search folder?
If you are searching in Splunk Enterprise Security, your data model needs to be accelerated to be used in Splunk ES. After activating acceleration for yout data model, it may take a few minutes to work, because Splunk ES runs crons (mostly about every 5 minutes) to look for data model. You can get more information in Splunk ES under > Audit > Data Model Audit. Hope this helps!