com.splunk
Class DataModelObject

java.lang.Object
  com.splunk.DataModelObject

Direct Known Subclasses:

DataModelSearch, DataModelTransaction

public class DataModelObject
extends java.lang.Object

DataModelObject represents one of the structured views in a data model.

Method Summary

boolean	containsField(java.lang.String fieldName) Checks whether there is a field with the given name in this data model object.
Job	createLocalAccelerationJob() Local acceleration is tsidx acceleration of a data model object that is handled manually by a user.
Job	createLocalAccelerationJob(java.lang.String earliestTime) Local acceleration is tsidx acceleration of a data model object that is handled manually by a user.
PivotSpecification	createPivotSpecification() Create a PivotSpecification on this data model object.
java.util.Collection<DataModelField>	getAutoExtractedFields() Get a collection of objects specifying all the fields that were automatically extracted from events (as opposed to generated by calculations in a data model).
DataModelCalculation	getCalculation(java.lang.String calculationId) Fetch a calculation by its unique ID.
java.util.Map<java.lang.String,DataModelCalculation>	getCalculations() Return the calculations done by this data model object to produce fields.
java.util.Collection<DataModelConstraint>	getConstraints()
DataModel	getDataModel() Fetch the data model on which this object is defined.
java.lang.String	getDisplayName()
DataModelField	getField(java.lang.String fieldName) Fetch a single field of a given name from this data model object.
java.util.Collection<DataModelField>	getFields() Return all the fields, whether input or created by calculations.
java.lang.String[]	getLineage() Data model objects can inherit from other data model objects in the same data model (or from a couple of global base objects such as BaseEvent and BaseTransaction).
java.lang.String	getName()
DataModelObject	getParent()
java.lang.String	getParentName() Returns the name of the parent of this object.
java.lang.String	getQuery()
Job	runQuery() Start a job that fetches all the events of this data model object.
Job	runQuery(JobArgs args) Start a job that fetches all the events of this data model object.
Job	runQuery(java.lang.String querySuffix) Start a job that applies querySuffix to all the events in this data model object.
Job	runQuery(java.lang.String querySuffix, JobArgs args) Start a job that applies querySuffix to all the events in this data model object.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

containsField

public boolean containsField(java.lang.String fieldName)

Checks whether there is a field with the given name in this data model object.

Parameters:

fieldName - name of the field to check for.

Returns:

true if there is such a field; false otherwise.

createLocalAccelerationJob

public Job createLocalAccelerationJob()

Local acceleration is tsidx acceleration of a data model object that is handled manually by a user. You create a job which generates an index, and then use that index in your pivots on the data model object. The namespace created by the job is 'sid={sid}' where {sid} is the job's sid. You would use it in another job by starting your search query with | tstats ... from sid={sid} | ... The tsidx index created by this job is deleted when the job is garbage collected by Splunk. It is the user's responsibility to manage this job, including cancelling it.

Returns:

a Job writing a tsidx index.

createLocalAccelerationJob

public Job createLocalAccelerationJob(java.lang.String earliestTime)

Local acceleration is tsidx acceleration of a data model object that is handled manually by a user. You create a job which generates an index, and then use that index in your pivots on the data model object. The namespace created by the job is 'sid={sid}' where {sid} is the job's sid. You would use it in another job by starting your search query with | tstats ... from sid={sid} | ... The tsidx index created by this job is deleted when the job is garbage collected by Splunk. It is the user's responsibility to manage this job, including cancelling it.

Parameters:

earliestTime - A time modifier (e.g., "-2w") setting the earliest time to index.

Returns:

a Job writing a tsidx index.

getCalculations

public java.util.Map<java.lang.String,DataModelCalculation> getCalculations()

Return the calculations done by this data model object to produce fields. Each calculation has a unique ID assigned to it by splunkd, which is the key in the returned map. For most purposes you will probably only want the values.

Returns:

a map of calculation IDs to DataModelCalculation objects.

getCalculation

public DataModelCalculation getCalculation(java.lang.String calculationId)

Fetch a calculation by its unique ID.

Parameters:

calculationId - a splunkd assigned unique ID for this calculation.

Returns:

a DataModelCalculation object.

getConstraints

public java.util.Collection<DataModelConstraint> getConstraints()

Returns:

a collection of the constraints limiting events that will appear in this data model object.

getDataModel

public DataModel getDataModel()

Fetch the data model on which this object is defined.

Returns:

A DataModel instance containing this object.

getDisplayName

public java.lang.String getDisplayName()

Returns:

the human readable name of this data model object.

getField

public DataModelField getField(java.lang.String fieldName)

Fetch a single field of a given name from this data model object.

Parameters:

fieldName - Name of the field to fetch.

Returns:

A DataModelField object, or null if there is no field of the given name.

getAutoExtractedFields

public java.util.Collection<DataModelField> getAutoExtractedFields()

Get a collection of objects specifying all the fields that were automatically extracted from events (as opposed to generated by calculations in a data model).

Returns:

a collection of DataModelField objects.

getFields

public java.util.Collection<DataModelField> getFields()

Return all the fields, whether input or created by calculations.

Returns:

a collection of DataModelField objects.

getQuery

public java.lang.String getQuery()

getName

public java.lang.String getName()

Returns:

Splunk's identifier for this data model object.

getLineage

public java.lang.String[] getLineage()

Data model objects can inherit from other data model objects in the same data model (or from a couple of global base objects such as BaseEvent and BaseTransaction). The lineage is a list of data model object names tracing this inheritance, starting with the most remote ancestor and ending with this object.

Returns:

An array of names, starting with this object's name, followed by the names up the hierarchy.

getParentName

public java.lang.String getParentName()

Returns the name of the parent of this object.

Returns:

a String giving the name.

getParent

public DataModelObject getParent()

Returns:

the data model object this one inherits from if it is a user defined data model object in the same data model; otherwise returns null (for example if the data model object inherits from BaseEvent or BaseTransaction).

createPivotSpecification

public PivotSpecification createPivotSpecification()

Create a PivotSpecification on this data model object.

Returns:

a PivotSpecification instance.

runQuery

public Job runQuery()

Start a job that fetches all the events of this data model object.

Returns:

a Job object.

runQuery

public Job runQuery(JobArgs args)

Start a job that fetches all the events of this data model object.

Parameters:

args - arguments specifying behavior of the job.

Returns:

a Job object.

runQuery

public Job runQuery(java.lang.String querySuffix)

Start a job that applies querySuffix to all the events in this data model object.

Parameters:

querySuffix - a search query, starting with a '|' that will be appended to the command to fetch the contents of this data model object (e.g., "| head 3").

Returns:

a Job object.

runQuery

public Job runQuery(java.lang.String querySuffix,
                    JobArgs args)

Start a job that applies querySuffix to all the events in this data model object.

Parameters:

querySuffix - a search query, starting with a '|' that will be appended to the command to fetch the contents of this data model object (e.g., "| head 3").

args - arguments to control the job.

Returns:

a Job object.