Splunk® Enterprise

Data Model and Pivot Tutorial

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Create a new data model

This topic shows you how to create new data models based on the tutorial data. Data models are created within Pivot and you need to have the admin or power role to create a data model.

Enable roles to create a data model

By default only users with the admin or power role can create data models. For other users, the ability to create a data model is tied to whether their roles have "write" access to an app. Since this tutorial uses a trial installation, you have admin privileges by default and should be able to continue.

If you are not able to create or edit a data model, you may need to check your permissions. For more information, read About data model permissions in the Knowledge Manager Manual.

Navigate to the Data Models management page

  1. If you are not in the Search app, click the App menu and select Search & Reporting app.
  2. In the Splunk bar, click Settings.
  3. 7.0 dmtutorial settings datamodel.png

  4. Under Knowledge, click Data Models.
  5. 7.0 dmtutorial datamodel manage.png

    This takes you to the Data Models management page. The Data Models management page lists the built-in data models and any data models that you have defined. For the Search app, there are two built-in data models.

    Use this page to manage the permissions, acceleration, cloning, and removal of existing data models. You also use this page to upload a data model or create a new data model.

Create a new data model

  1. In the Data Models page, click New Data Model.
  2. 6.2tutorial datamodel new.png

  3. In the New Data Model dialog box, for Title type Buttercup Games.
    The Title field accepts any character, as well as spaces.
  4. Optional. For ID, type Tutorial.
    If you don't change the ID, it automatically uses the same name as the title, without spaces. In this example it uses Buttercup_Games.
    The ID must be a unique identifier for the data model. It cannot contain spaces or any characters that aren't alphanumeric, underscores, or hyphens (a-z, A-Z, 0-9, _, or -). Spaces between characters are also not allowed. Once you define the data model ID, you can't change it.
  5. For App, select Search & Reporting.
  6. Optional. For Description, type Enables data analysis and reporting for tutorial data.
  7. Click Create. The editor page for the new Buttercup Games data model appears. You will edit add a root dataset to this data model in the next step.
  8. 7.0 dmtutorial new datamodel.png

  9. Click the link All Data Models.
    The Data Models page shows the new Buttercup Games data model that you created.

Note: There was a terminology change in version 6.5.0 from "objects" to "datasets". For more information about data model datasets, see About data models datasets.

Next steps

Continue to the next topic to add a root dataset to the Buttercup Games data model.

About data models and data model datasets
Define a root dataset for the data model

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters