We have one standard mode federated index on a remote Splunk cluster. A local data model (model1) has a base search of index="federated:blah" |head10.
Using the search dialog for 'index="federated:blah" | head10', we get 10 results as expected. Running '| from datamodel model1' we get nothing.
Inspecting the search.log, we see the remote Splunk instance being queried when using the search dialog. When calling the data model, there doesn't seem to be any communication out to the remote instance.
Does standard mode federated search not support local data models querying a federated index? Am I doing something wrong?
