Splunk Search

Splunk 8.0.1: Getting error when using | from datamodel:$model$ to put parameters on a saved search.

bowesmana
SplunkTrust
SplunkTrust

I have a saved search that does:

 

| from datamodel:"Performance.Storage"

 

But, I am trying to make this saved search parameterized using:

 

| from datamodel:"$model$"

 

When I try to edit the search in the GUI, it throws this error:

 

Error in 'SearchOperator:datamodel': Error in 'DataModelEvaluator': Data model '$model$' was not found.

 

If I edit savedsearches.conf directly and change the SPL to use $model$ then it runs with no problem and parameterizes the search accordingly.

Is this a bug in the UI? I'm using Splunk 8.0.1.

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

The reason for parameterising the saved search is so that the search can be called from a map command passing model=X

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

OK, so I revisited this one - I thought I'll make a macro and give it a parameter and pass the replacement variable to the macro, i.e. 

`datamodel_search("$model$")`

but that has the same problem - same message.

Are there any Splunk employees there who can confirm if the GUI behaviour is correct, i.e. it should not be allowed, or if the GUI has a bug, because in savedsearches.conf, it works when using $model$

 

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...