Splunk® Enterprise

Search Reference

Download manual as PDF

Download topic as PDF



Examine data model or data model dataset and search a data model dataset.

Use the datamodel command to return the JSON for all or a specified data model and its datasets. You can also search against the specified data model dataset.

A data model is a hierarchically-structured search-time mapping of semantic knowledge about one or more datasets. A data model encodes the domain knowledge necessary to build a variety of specialized searches of those datasets. These specialized searches are in turn used by the search to generate reports for Pivot users. For more information, see About data models and Design data models in the Knowledge Manager Manual.

The datamodel search command lets you search existing data models and their datasets from the search interface.

The datamodel command is a generating command and should be the first command in the search. Generating commands use a leading pipe character.


| datamodel [<data model name>] [<dataset name>] [<search>]

Required arguments


Optional arguments

data model name
Syntax: <string>
Description: The name of the data model to search. When only the data model is specified, the search returns the JSON for the single data model.
dataset name
Syntax: <string>
Description: The name of a data model dataset to search. Must be specified after the data model name. The search returns the JSON for the single dataset.
Syntax: <search>
Description: Indicates to run the search associated with the specified data model and object. For more information, see the search command.


The datamodel command is a report-generating command. See Command types.

Generating commands use a leading pipe character and should be the first command in a search.


1. Return the JSON for all data models

Return JSON for all data models available in the current app context.

| datamodel

This image shows the JSON for the built-in data models for the Search app.

2. Return the JSON for a specific datamodel

Return JSON for the Splunk's Internal Audit Logs - SAMPLE data model, which has the model ID internal_audit_logs.

| datamodel internal_audit_logs

This image shows the JSON for the internal audit logs, which is a built-in datamodel.

3. Return the JSON for a specific dataset

Return JSON for Buttercup Games's Client_errors dataset.

| datamodel Tutorial Client_errors

4. Run a search on a specific dataset

Run the search for Buttercup Games's Client_errors.

| datamodel Tutorial Client_errors search

5. Run a search a dataset for specific criteria

Search Buttercup Games's Client_errors dataset for 404 errors and count the number of events.

| datamodel Tutorial Client_errors search | search Tutorial.status=404 | stats count

See also



Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has about using the datamodel command.


This documentation applies to the following versions of Splunk® Enterprise: 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.3.0


"from datamodel" and datamodel now actively remove extracted fields from the raw logs. See release notes: https://docs.splunk.com/Documentation/Splunk/7.1.0/Installation/AboutupgradingREADTHISFIRST#Data_model_searches_now_only_use_fields_that_have_been_defined_within_the_data_model
A VERY bad idea, as the raw logs from drilldowns can not be analyzed anymore, with their native fields missing. We requested to restore the old behavior (SPL-166843), but no idea if/when this will be done.
Meanwhile a partial workaround is to add "extract" to all your drilldowns to reextract the fields. But this will not help with calculated/looked up fields, therefore we replaced "from datamodel" in the drilldowns with a macro that does the extract and the necessary evals.
Also asset/identity investigator are harder to use because for any drilldown in there you have to add your macro manually.

April 5, 2019

The example that you give ("| datamodel Tutorial Client_errors search | search status=404 | stats count") used to work in the 6.? days but something was broken along the way such that the "|datamodel" command now works like the "| from datamodel" command in that ONLY the fields defined in the datamodel are available. It used to be that "|datamodel" gave all fields, so your example would work, but no longer. Yes, this means that the vast majority of ES drilldown searches are borked because most of them use "|datamodel".

November 14, 2018

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters