Splunk® Enterprise

Data Model and Pivot Tutorial

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Create a new data model

This topic shows you how to create new data models based on the tutorial data. Data models are created within Pivot and you need to have admin or power role to create a data model.

Enable roles to create a data model

By default only users with the admin or power role can create data models. For other users, the ability to create a data model is tied to whether their roles have "write" access to an app. Since this is a first time install, you have admin privileges by default and should be able to continue.

If you are not able to create or edit a data model, you may need to check your permissions. For more information, read "About data model permissions" in the Knowledge Manager Manual.

Navigate to data model management page

Data models are created in Pivot.

1. If you're not in Splunk Home, Return to Home by clicking on the Splunk logo in the Splunk bar.

2. Then, under the Search & Reporting app, click Pivot.

This takes you to the Select a Data Model page. This page exists to enable Pivot users to choose the data model they wish to use to create a pivot.

Dmpt select a datamodel.png

3. Next, click Manage Data Models to bring up the Data Models management page.

Dmpt manage datamodels.png

The Data Models management page is a listing page of data models. It enables you to manage the permissions, acceleration, cloning, and removal of existing data models. It also enables you to create new data models.

You can access the page from anywhere in Splunk through the Settings list. Just navigate to Settings > Data Models and click Manage Data Models.

Create a new data model

In the Create New Data Model Dialog:

1. Enter the Title: "Buttercup Games"

The Title field accepts any character, as well as spaces. The value you enter here is what appears on the data model listing pages.

2. Enter the ID: "Tutorial"

This is optional. If you don't change the ID, it automatically reads "Buttercup_Games".

The ID must be a unique identifier for the data model. It cannot contain spaces or any characters that aren't alphanumeric, underscores, or hyphens (a-z, A-Z, 0-9, _, or -). Spaces between characters are also not allowed. Once you define the data model ID, you can't change it.

3. Select the "Search & Reporting" App from the menu.

4. Enter the following Description: "Enables data analytics and reporting for tutorial data."

Dmpt new data model.png

5. Click Create to open the Buttercup Games Edit Objects page.

Dmpt edit objects.png

This page enables you to create objects for the data model, define their constraints and attributes, arrange the objects in logical hierarchies, and maintain them.

Next steps

Continue to the next topic to add a root object to the Buttercup Games data model.

About data models and data model objects
Define a root object for the data model

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters