Splunk® Enterprise

Data Model and Pivot Tutorial

Splunk Enterprise version 7.0 is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Create a new data model

This topic shows you how to create new data models based on the tutorial data. Data models are created within Pivot and you need to have the admin or power role to create a data model.

Enable roles to create a data model

By default only users with the admin or power role can create data models. For other users, the ability to create a data model is tied to whether their roles have "write" access to an app. Since this tutorial uses a trial installation, you have admin privileges by default and should be able to continue.

If you are not able to create or edit a data model, you may need to check your permissions. For more information, read About data model permissions in the Knowledge Manager Manual.

Navigate to the Data Models management page

  1. If you are not in the Search app, click the App menu and select Search & Reporting app.
  2. In the Splunk bar, click Settings.
  3. 7.0 dmtutorial settings datamodel.png

  4. Under Knowledge, click Data Models.
  5. 7.0 dmtutorial datamodel manage.png

    This takes you to the Data Models management page. The Data Models management page lists the built-in data models and any data models that you have defined. For the Search app, there are two built-in data models.

    Use this page to manage the permissions, acceleration, cloning, and removal of existing data models. You also use this page to upload a data model or create a new data model.

Create a new data model

  1. In the Data Models page, click New Data Model.
  2. 6.2tutorial datamodel new.png

  3. In the New Data Model dialog box, for Title type Buttercup Games.
    The Title field accepts any character, as well as spaces.
  4. Optional. For ID, type Tutorial.
    If you don't change the ID, it automatically uses the same name as the title, without spaces. In this example it uses Buttercup_Games.
    The ID must be a unique identifier for the data model. It cannot contain spaces or any characters that aren't alphanumeric, underscores, or hyphens (a-z, A-Z, 0-9, _, or -). Spaces between characters are also not allowed. Once you define the data model ID, you can't change it.
  5. For App, select Search & Reporting.
  6. Optional. For Description, type Enables data analysis and reporting for tutorial data.
  7. Click Create. The editor page for the new Buttercup Games data model appears. You will edit add a root dataset to this data model in the next step.
  8. 7.0 dmtutorial new datamodel.png

  9. Click the link All Data Models.
    The Data Models page shows the new Buttercup Games data model that you created.

Note: There was a terminology change in version 6.5.0 from "objects" to "datasets". For more information about data model datasets, see About data models datasets.

Next steps

Continue to the next topic to add a root dataset to the Buttercup Games data model.

Last modified on 16 February, 2018
About data models and data model datasets   Define a root dataset for the data model

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters