allFieldNames

splunkjs.Service.DataModelObject.allFieldNames

Returns a string array of the field names of this data model object's calculations, and the names of this data model object's fields.

Syntax

allFieldNames: function()

Return

Array.

An array of strings with the field names of this
data model object's calculations, and the names of fields on
this data model object.

allFields

splunkjs.Service.DataModelObject.allFields

Returns an array of data model fields from this data model object's calculations, and this data model object's fields.

Syntax

allFields: function()

Return

Array.

An array of splunk.Service.DataModelField objects
which includes this data model object's fields, and the fields from
this data model object's calculations.

calculatedFieldNames

splunkjs.Service.DataModelObject.calculatedFieldNames

Returns a string array of the field names of this data model object's calculations.

Syntax

calculatedFieldNames: function()

Return

Array.

An array of strings with the field names of this
data model object's calculations.

calculatedFields

splunkjs.Service.DataModelObject.calculatedFields

Returns an array of data model fields from this data model object's calculations.

Syntax

calculatedFields: function(

Return

Array.

An array of splunk.Service.DataModelField objects
of the fields from this data model object's calculations.

calculationIDs

splunkjs.Service.DataModelObject.calculationIDs

Returns a string array of the IDs of this data model object's calculations.

Syntax

calculationIDs: function()

Return

Array.

An array of strings with the IDs of this data model
object's calculations.

createLocalAccelerationJob

splunkjs.Service.DataModelObject.createLocalAccelerationJob

Local acceleration is tsidx acceleration of a data model object that is handled manually by a user. You create a job which generates an index, and then use that index in your pivots on the data model object.

The namespace created by the job is 'sid={sid}' where {sid} is the job's sid. You would use it in another job by starting your search query with | tstats ... from sid={sid} | ...

The tsidx index created by this job is deleted when the job is garbage collected by Splunk.

It is the user's responsibility to manage this job, including cancelling it.

Syntax

createLocalAccelerationJob: function(earliestTime, callback)

Parameters

Name Type Description
earliestTime String

A time modifier (e.g., "-2w") setting the earliest time to index.

callback Function

A function to call with the search job: (err, accelerationJob).

Examples

 service.dataModels().fetch(function(err, dataModels) {
     var object = dataModels.item("some_data_model").objectByName("some_object");
     object.createLocalAccelerationJob("-1d", function(err, accelerationJob) {
         console.log("The job has name:", accelerationJob.name);
     });
 });

createPivotSpecification

splunkjs.Service.DataModelObject.createPivotSpecification

Returns a new Pivot Specification, accepts no parameters.

Syntax

createPivotSpecification: function()

Return

splunkjs.Service.PivotSpecification.

A new pivot specification.

fieldByName

splunkjs.Service.DataModelObject.fieldByName

Returns a data model field instance, representing a field on this data model object.

Syntax

fieldByName: function(name)

Return

splunkjs.Service.DataModelField,null.

The data model field
from this data model object with the specified name, null if it the
field by that name doesn't exist.

fieldNames

splunkjs.Service.DataModelObject.fieldNames

Returns a string array of the names of this data model object's fields.

Syntax

fieldNames: function()

Return

Array.

An array of strings with the field names of this
data model object.

hasField

splunkjs.Service.DataModelObject.hasField

Returns whether this data model object contains the field with the name passed in the fieldName parameter.

Syntax

hasField: function(fieldName)

Parameters

Name Type Description
fieldName String

The name of the field to look for.

Return

Boolean.

True if this data model contains the field by name.

init

splunkjs.Service.DataModelObject.init

Constructor for a data model object. SDK users are not expected to invoke this constructor directly.

Syntax

init: function(props, parentDataModel)

Parameters

Name Type Description
props Object

A dictionary of properties to set:
- objectName (string): The name for this data model object.
- displayName (string): A human readable name for this data model object.
- parentName (string): The name of the data model that owns this data model object.
- lineage (string): The lineage of the data model that owns this data model object,
items are delimited by a dot. This is converted into an array of
strings upon construction.
- fields (array): An array of data model fields.
- constraints (array): An array of data model constraints.
- calculations (array): An array of data model calculations.
- baseSearch (string): The search query wrapped by this data model object; exclusive to BaseSearch (optional)
- groupByFields (array): The fields that will be used to group events into transactions; exclusive to BaseTransaction (optional)
- objectsToGroup (array): Names of the data model objects that should be unioned
and split into transactions; exclusive to BaseTransaction (optional)
- maxSpan (string): The maximum time span of a transaction; exclusive to BaseTransaction (optional)
- maxPause (string): The maximum pause time of a transaction; exclusive to BaseTransaction (optional)

parentDataModel splunkjs.Service.DataModel

The DataModel that owns this data model object.

isBaseSearch

splunkjs.Service.DataModelObject.isBaseSearch

Is this data model object a BaseSearch?

Syntax

isBaseSearch: function()

Return

Boolean.

Whether this data model object is the root type, BaseSearch.

isBaseTransaction

splunkjs.Service.DataModelObject.isBaseTransaction

Is this data model object is a BaseTransaction?

Syntax

isBaseTransaction: function()

Return

Boolean.

Whether this data model object is the root type, BaseTransaction.

parent

splunkjs.Service.DataModelObject.parent

Returns the data model object this one inherits from if it is a user defined, otherwise return null.

Syntax

parent: function()

Return

splunkjs.Service.DataModelObject,null.

This data model object's parent
or null if this is not a user defined data model object.

startSearch

splunkjs.Service.DataModelObject.startSearch

Start a search job that applies querySuffix to all the events in this data model object.

Syntax

startSearch: function(params, querySuffix, callback)

Parameters

Name Type Description
params Object

A dictionary of properties for the search job. For a list of available parameters, see Search job parameters on Splunk Developer Portal.
Note: This method throws an error if the exec_mode=oneshot parameter is passed in with the properties dictionary.

querySuffix String

A search query, starting with a '|' that will be appended to the command to fetch the contents of this data model object (e.g., "| head 3").

callback Function

A function to call with the search job: (err, job).

Examples

 service.dataModels().fetch(function(err, dataModels) {
     var object = dataModels.item("internal_audit_logs").objectByName("searches");
     object.startSearch({}, "| head 5", function(err, job) {
         console.log("The job has name:", job.name);
     });
 });