Define a root dataset for the data model
In the last topic, you created the data model called Buttercup Games
.
This topic walks you through adding a root dataset for Buttercup Games purchases.
Add a root dataset
- From the Data Models list, click Buttercup Games.
This opens the Buttercup Games dataset in the editor page. You use the editor page to design a new data model or redesign an existing data model. You can create datasets for your data model, define their constraints and fields, arrange them in logical dataset hierarchies, and maintain them.Data models are typically composed of dataset hierarchies built on root event datasets. Each root event dataset represents a set of data that is defined by a constraint, which is a simple search that filters out events that are not relevant to the dataset. For more information about root event datasets and root search datasets see Design data models.
Let's create a dataset to track purchase requests on the Buttercup Games website. - For Dataset Name type
Purchase Requests
. The Dataset Name field can accept any character, including spaces. - Optional. The Dataset ID field is automatically populated when you type in the Dataset Name. The value Purchase_Requests should appear in the field.
The Dataset ID must be a unique identifier for the dataset. The ID can be comprised of alphanumeric, underscore, or hyphen (a-z, A-Z, 0-9, _, or -) characters. Spaces are not allowed.
After you add the dataset, you cannot change the Dataset ID.
- In the Contraints field, type this search constraint:
sourcetype=access_* action=purchase
.
This constraint limits the dataset to events that are web access page requests that are purchase events.
Next steps
Continue to the next topic to add more fields to the Purchase Requests dataset.
Create a new data model | Edit fields list |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13
Feedback submitted, thanks!