Define a root object for the data model
In the last topic, you created the data model "Buttercup Games".
This topic walks you through adding a root object for Buttercup Games purchases.
Edit data model objects
1. From the Data Models list, click Buttercup Games.
This opens the Buttercup Games object editor view.
Use the Edit Objects page to design a new data model or redesign an existing data model. On the Edit Objects page, you can create objects for your data model, define their constraints and attributes, arrange them in logical object hierarchies, and maintain them.
Add a root object
Data models are typically composed of object hierarchies built on root event objects. Each root event object represents a set of data that is defined by a constraint, which is a simple search that filters out events that are not relevant to the object. For more information about root event objects and root search objects see Design data models and objects in the Knowledge Manager Manual.
Let's create an object to track purchase requests on the Buttercup Games website.
1. To define the data model's first event base object, click Add Object.
Your first root object can be either a Root event or Root search.
2. Select Root event.
This takes you to the Add Event Object editor.
3. Enter the Object Name: Purchase Requests
The Object Name field can accept any character, as well as spaces. It's what you'll see on the Choose an Object page and other places where data model objects are listed.
4. Enter the Object ID: Purchase_Requests
This should automatically populate when you type in the Object Name. You can edit it if you want to change it.
The Object ID must be a unique identifier for the object. It cannot contain spaces or any characters that aren't alphanumeric, underscores, or hyphens (a-z, A-Z, 0-9, _, or -). Spaces between characters are also not allowed. Once you save the Object ID value, you can't edit it.
5. Enter the following search Constraints:
This defines the web access page requests that are purchase events.
After you provide Constraints for the event base object you can click Preview to test whether the constraints you've supplied return the kinds of events you want.
6. Click Save.
The list of attributes for the root object include: host, source, sourcetype, and _time. If you want to add child objects to client and server errors, you need to edit the attributes list to include additional attributes.
Continue to the next topic to add more attributes to Purchase Requests.
Create a new data model
Edit attributes list
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11