How can rewrite scheduled searches to datamodels

[graceojo34]

Thanks @richgalloway  I will look into my task again.

[woodcock]

Install Splunk Security Essentials and look at the difference between the "Live Data" and "Accelerated Data" tabs when you click into a piece of security content (such as "Brute Force Detection".  It will teach you how to translate back and forth.  We also do this for clients who hire us as it can get tricky.

[graceojo34]

Thanks Woodcook, will try that.

[richgalloway]

Data models do not replace scheduled searches.  DMs are a special form of scheduled search that pre-fetch data into TSIDX files for faster access.  You still need scheduled searches to retrieve data from the DM and shape it into a report or alert.

What problem are you trying to solve?