Splunk® Business Flow (EOL)

User Manual

Splunk Business Flow is no longer available for purchase as of June 20, 2020. Customers who have already purchased Business Flow will continue to have support and maintenance per standard support terms for the remainder of contractual commitments.

What is a Flow Model in Splunk Business Flow?

"Flow Model" refers to a grouping of discrete information which represents a transaction, session, or other business process that is configured within Splunk Business Flow. The Flow Model contains a repository of events that you are interested in analyzing. In the Flow Model, you define what field names you want to track, and how you want to correlate events. The following components make up a Flow Model definition: a search and the fields that represent one or more Correlation IDs, Steps, and Attributes. The Search scans the event logs, transforms or extracts events based on the specifications of the search, and then returns the results. The Flow Model definition determines how SBF identifies and groups related events into ordered sequences called Journeys.

Preview your Flow Model in the Explorer, then save your analysis as a Flow. Flows depend on Flow Models. If you modify a Flow Model, the changes extend to all related Flows.

The following animation illustrates how to create a Flow Model.

The following animation shows how to add a Flow Model and launch the Explorer. The animation starts from the home page. Then, the user clicks the Add new Flow Model button. A pop-up message appears, and the user enters a name and base search for the Flow Model and clicks submit. In the Flow Model editor, the user selects customer_id under correlation ID and action under step, and then clicks Explore. The Explore view shows a flowchart of steps, starting with "new account created" and ending in "purchased game".

Last modified on 21 August, 2019
 

This documentation applies to the following versions of Splunk® Business Flow (EOL): -Latest-

Acrobat logo Download manual
Acrobat logo Download this page

Please expect delayed responses to documentation feedback while the team migrates content to a new system. We value your input and thank you for your patience as we work to provide you with an improved content experience!

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters