All Apps and Add-ons
Highlighted

Palo Alto Networks App: failed to manually move data models in Splunk Enterprise

New Member

I want to manually move the data models "pan_firewall" i downloaded to the Search&Reporting in splunk enterprise.

i put the panfirewall.json file into C:\Program Files\Splunk\etc\apps\search\default\data\models and i also moved the stanza in datamodels.conf and metadata in local.meta and default meta. i am able to search and display the datamodel by command |datamodel in the search bar but i could not search by | from datamodel:"panfirewall" and it said Data model 'pan_firewall' was not found.

i am confused. Do i need to also move the stanza of other files such as event types, inputs, props etc, the files related to the data models to the search folder?

0 Karma
Highlighted

Re: Palo Alto Networks App: failed to manually move data models in Splunk Enterprise

Communicator

If you are searching in Splunk Enterprise Security, your data model needs to be accelerated to be used in Splunk ES. After activating acceleration for yout data model, it may take a few minutes to work, because Splunk ES runs crons (mostly about every 5 minutes) to look for data model. You can get more information in Splunk ES under > Audit > Data Model Audit. Hope this helps!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.