Splunk® Enterprise

Search Reference

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

datamodel

Description

Examine data model or data model object and search a data model object.

Use the datamodel command to return the JSON for all or a specified data model and its objects. You can also search against the specified data model object.

A data model is a hierarchically-structured search-time mapping of semantic knowledge about one or more datasets. A data model encodes the domain knowledge necessary to build a variety of specialized searches of those datasets. These specialized searches are in turn used by the search to generate reports for Pivot users.

The datamodel search command lets you search existing data models and their objects from the search interface.

The datamodel command is a generating command and should be the first command in the search. Generating commands use a leading pipe character.

Syntax

| datamodel [<data model name>] [<object name>] [<search>]

Required arguments

None

Optional arguments

data model name
Syntax: <string>
Description: The name of the data model to search. When only the data model is specified, the search returns the JSON for the single data model.
object name
Syntax: <string>
Description: The name of a data model object to search. Must be specified after the data model name. The search returns the JSON for the single object.
search
Syntax: <search>
Description: Indicates to run the search associated with the specified data model and object. For more information, see the search command.

Usage

The datamodel command is a generating command and should be the first command in the search. Generating commands use a leading pipe character.

Examples

The following examples are created using data from the "Data Model and Pivot Tutorial".

Example 1:

Return JSON for all data models available in the current app context.

| datamodel

Datamodel command default.png

Example 2:

Return JSON for the "Buttercup Games" data model, which has the model ID "Tutorial".

| datamodel Tutorial

Datamodel command tutorialdata.png

Example 3:

Return JSON for Buttercup Games's Client_errors object.

| datamodel Tutorial Client_errors

Datamodel command tutorial object.png

Example 4:

Run the search for Buttercup Games's Client_errors.

| datamodel Tutorial Client_errors search

Example 5:

Search Buttercup Games's Client_errors object for 404 errors and count the number of events.

| datamodel Tutorial Client_errors search | search status=404 | stats count


See also

pivot

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has about using the datamodel command.

PREVIOUS
ctable
  NEXT
dbinspect

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.2.13, 6.2.14, 6.2.15


Comments

how does the datamodel command interact with accelerated datamodels? My guess is that it will take advantage of any available summaries, but it would be great to see this explicitly specified. Also, maybe a mention of how this relates to tstats, which seems somewhat similar in the case of accelerated datamodels.

Muebel
January 6, 2016

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters