I have a saved search that does:
| from datamodel:"Performance.Storage"
But, I am trying to make this saved search parameterized using:
| from datamodel:"$model$"
When I try to edit the search in the GUI, it throws this error:
Error in 'SearchOperator:datamodel': Error in 'DataModelEvaluator': Data model '$model$' was not found.
If I edit savedsearches.conf directly and change the SPL to use $model$ then it runs with no problem and parameterizes the search accordingly.
Is this a bug in the UI? I'm using Splunk 8.0.1.
The reason for parameterising the saved search is so that the search can be called from a map command passing model=X
OK, so I revisited this one - I thought I'll make a macro and give it a parameter and pass the replacement variable to the macro, i.e.
but that has the same problem - same message.
Are there any Splunk employees there who can confirm if the GUI behaviour is correct, i.e. it should not be allowed, or if the GUI has a bug, because in savedsearches.conf, it works when using $model$