Splunk® Enterprise

Data Model and Pivot Tutorial

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Create a new data model

This topic shows you how to create new data models based on the tutorial data. Data models are created within Pivot and you need to have the admin or power role to create a data model.

Enable roles to create a data model

By default only users with the admin or power role can create data models. For other users, the ability to create a data model is tied to whether their roles have "write" access to an app. Since this tutorial uses a trial installation, you have admin privileges by default and should be able to continue.

If you are not able to create or edit a data model, you may need to check your permissions. For more information, read About data model permissions in the Knowledge Manager Manual.

Navigate to the Data Models management page

  1. In the Splunk bar, click Settings.
    6.2tutorial settings datamodel.png

  2. Under Knowledge, click Data Models.
    6.2tutorial datamodel manage.png
    This takes you to the Data Models management page. The Data Models management page lists any data models you have defined. Use this page to manage the permissions, acceleration, cloning, and removal of existing data models. You can also use this page to upload a data model or create new data models, using the Upload Data Model and New Data Model buttons on the top right.

Create a new data model

  1. In the Data Models management page, click New Data Model. This opens the New Data Model dialog box.
    6.2tutorial datamodel new.png

  2. Enter the Title, "Buttercup Games" The Title field accepts any character, as well as spaces. The value you enter here is what appears on the data model listing pages.
  3. (Optional) Enter the ID, "Tutorial" If you don't change the ID, it automatically reads "Buttercup_Games". The ID must be a unique identifier for the data model. It cannot contain spaces or any characters that aren't alphanumeric, underscores, or hyphens (a-z, A-Z, 0-9, _, or -). Spaces between characters are also not allowed. Once you define the data model ID, you can't change it.
  4. Next to App, select "Search & Reporting" from the menu.
  5. (Optional) Enter the Description, "Enables data analysis and reporting for tutorial data."
  6. Click Create. This opens the Buttercup Games Edit Datasets page. Use this page to create datasets for the new data model, define their constraints and fields, arrange the datasets in logical hierarchies, and manage them.

Note: There was a terminology change in 6.5.0 from "objects" to "datasets". For more information about data model datasets, see About data models datasets.

Next steps

Continue to the next topic to add a root dataset to the Buttercup Games data model.

Last modified on 11 September, 2017
About data models and data model datasets
Define a root dataset for the data model

This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters