Splunk Search

Splunk 8.0.1: Getting error when using | from datamodel:$model$ to put parameters on a saved search.

bowesmana
SplunkTrust
SplunkTrust

I have a saved search that does:

 

| from datamodel:"Performance.Storage"

 

But, I am trying to make this saved search parameterized using:

 

| from datamodel:"$model$"

 

When I try to edit the search in the GUI, it throws this error:

 

Error in 'SearchOperator:datamodel': Error in 'DataModelEvaluator': Data model '$model$' was not found.

 

If I edit savedsearches.conf directly and change the SPL to use $model$ then it runs with no problem and parameterizes the search accordingly.

Is this a bug in the UI? I'm using Splunk 8.0.1.

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

The reason for parameterising the saved search is so that the search can be called from a map command passing model=X

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

OK, so I revisited this one - I thought I'll make a macro and give it a parameter and pass the replacement variable to the macro, i.e. 

`datamodel_search("$model$")`

but that has the same problem - same message.

Are there any Splunk employees there who can confirm if the GUI behaviour is correct, i.e. it should not be allowed, or if the GUI has a bug, because in savedsearches.conf, it works when using $model$

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...