Splunk Search

Splunk 8.0.1: Getting error when using | from datamodel:$model$ to put parameters on a saved search.

bowesmana
SplunkTrust
SplunkTrust

I have a saved search that does:

 

| from datamodel:"Performance.Storage"

 

But, I am trying to make this saved search parameterized using:

 

| from datamodel:"$model$"

 

When I try to edit the search in the GUI, it throws this error:

 

Error in 'SearchOperator:datamodel': Error in 'DataModelEvaluator': Data model '$model$' was not found.

 

If I edit savedsearches.conf directly and change the SPL to use $model$ then it runs with no problem and parameterizes the search accordingly.

Is this a bug in the UI? I'm using Splunk 8.0.1.

 

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

The reason for parameterising the saved search is so that the search can be called from a map command passing model=X

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

OK, so I revisited this one - I thought I'll make a macro and give it a parameter and pass the replacement variable to the macro, i.e. 

`datamodel_search("$model$")`

but that has the same problem - same message.

Are there any Splunk employees there who can confirm if the GUI behaviour is correct, i.e. it should not be allowed, or if the GUI has a bug, because in savedsearches.conf, it works when using $model$

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...