Splunk Search

Splunk 8.0.1: Getting error when using | from datamodel:$model$ to put parameters on a saved search.

bowesmana
SplunkTrust
SplunkTrust

I have a saved search that does:

 

| from datamodel:"Performance.Storage"

 

But, I am trying to make this saved search parameterized using:

 

| from datamodel:"$model$"

 

When I try to edit the search in the GUI, it throws this error:

 

Error in 'SearchOperator:datamodel': Error in 'DataModelEvaluator': Data model '$model$' was not found.

 

If I edit savedsearches.conf directly and change the SPL to use $model$ then it runs with no problem and parameterizes the search accordingly.

Is this a bug in the UI? I'm using Splunk 8.0.1.

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

The reason for parameterising the saved search is so that the search can be called from a map command passing model=X

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

OK, so I revisited this one - I thought I'll make a macro and give it a parameter and pass the replacement variable to the macro, i.e. 

`datamodel_search("$model$")`

but that has the same problem - same message.

Are there any Splunk employees there who can confirm if the GUI behaviour is correct, i.e. it should not be allowed, or if the GUI has a bug, because in savedsearches.conf, it works when using $model$

 

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...