Splunk Search

Splunk 8.0.1: Getting error when using | from datamodel:$model$ to put parameters on a saved search.

bowesmana
SplunkTrust
SplunkTrust

I have a saved search that does:

 

| from datamodel:"Performance.Storage"

 

But, I am trying to make this saved search parameterized using:

 

| from datamodel:"$model$"

 

When I try to edit the search in the GUI, it throws this error:

 

Error in 'SearchOperator:datamodel': Error in 'DataModelEvaluator': Data model '$model$' was not found.

 

If I edit savedsearches.conf directly and change the SPL to use $model$ then it runs with no problem and parameterizes the search accordingly.

Is this a bug in the UI? I'm using Splunk 8.0.1.

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

The reason for parameterising the saved search is so that the search can be called from a map command passing model=X

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

OK, so I revisited this one - I thought I'll make a macro and give it a parameter and pass the replacement variable to the macro, i.e. 

`datamodel_search("$model$")`

but that has the same problem - same message.

Are there any Splunk employees there who can confirm if the GUI behaviour is correct, i.e. it should not be allowed, or if the GUI has a bug, because in savedsearches.conf, it works when using $model$

 

0 Karma
Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...