Examine and search data model datasets.
datamodel command to return the JSON for all or a specified data model and its datasets. You can also search against the specified data model or a dataset within that datamodel.
A data model is a hierarchically-structured search-time mapping of semantic knowledge about one or more datasets. A data model encodes the domain knowledge necessary to build a variety of specialized searches of those datasets. For more information, see About data models and Design data models in the Knowledge Manager Manual.
datamodel search command lets you search existing data models and their datasets from the search interface.
datamodel command is a generating command and should be the first command in the search. Generating commands use a leading pipe character.
| datamodel [<data model name>] [<dataset name>] [<data model search mode>] [strict_fields=<bool>] [allow_old_summaries=<bool>] [summariesonly=<bool>]
- data model name
- Syntax: <string>
- Description: The name of the data model to search. When only the data model is specified, the search returns the JSON for the single data model.
- dataset name
- Syntax: <string>
- Description: The name of a data model dataset to search. Must be specified after the data model name. The search returns the JSON for the single dataset.
- data model search mode
- Syntax: <data model search result mode> | <data model search string mode>
- Description: You can use
datamodelto run a search against a data model or a data model dataset that returns either results or a search string. If you want to do this, you must provide a
<data model search mode>. There are two
<data model search mode>subcategories: modes that return results and modes that return search strings. See <data model search mode> options.
- Syntax: allow_old_summaries=<bool>
- Description: This argument applies only to accelerated data models. When you change the constraints that define a data model but the Splunk software has not fully updated the summaries to reflect that change, the summaries may have some data that matches the old definition and some data that matches the new definition. By default,
allow_old_summaries = false, which means that the search head does not use summary directories that are older than the new summary definition. This ensures that the
datamodelsearch results always reflect your current configuration. When you set
allow_old_summaries = true,
datamodeluses both current summary data and summary data that was generated prior to the definition change. You can set
allow_old_summaries=truein your search if you feel that the old summary data is close enough to the new summary data that its results are reliable.
- Default: false
- Syntax: summariesonly=<bool>
- Description: This argument applies only to accelerated data models. When set to false, the
datamodelsearch returns both summarized and unsummarized data for the selected data model. When set to true, the search returns results only from the data that has been summarized in TSIDX format for the selected data model. You can use this argument to identify what data is currently summarized for a given data model, or to ensure that a particular data model search runs efficiently.
- Default: false
- Syntax: strict_fields=<bool>
- Description: Determines the scope of the
datamodelsearch in terms of fields returned. When
strict_fields=true, the search returns only default fields and fields that are included in the constraints of the specified data model dataset. When
strict_fields=false, the search returns all fields defined in the data model, including fields inherited from parent data model datasets, extracted fields, calculated fields, and fields derived from lookups.
- You can also arrange for
strict_fieldsto default to
falsefor a specific data model. See Design data models in the Knowledge Manager Manual.
- Default: true
<data model search mode> options
- data model search result mode
- Syntax: search | flat | acceleration_search
- Description: The modes for running searches on a data model or data model dataset that return results.
Returns the search results exactly how they are defined.
Returns the same results as the
search, except that it strips the hierarchical information from the field names. For example, where
searchmode might return a field named
flatmode returns a field named
Runs the search that the search head uses to accelerate the data model. This mode works only on root event datasets and root search datasets that only use streaming commands.
- data model search string mode
- Syntax: search_string | flat_string | acceleration_search_string
- Description: These modes return the strings for the searches that the Splunk software is actually running against the data model when it runs your SPL through the corresponding
<data model search result mode>. For example, if you choose
acceleration_search_string, the Splunk software returns the search string it would actually use against the data model when you run your SPL through
datamodel command is a report-generating command. See Command types.
Generating commands use a leading pipe character and should be the first command in a search.
1. Return the JSON for all data models
Return JSON for all data models available in the current app context.
2. Return the JSON for a specific datamodel
Return JSON for the Splunk's Internal Audit Logs - SAMPLE data model, which has the model ID internal_audit_logs.
| datamodel internal_audit_logs
3. Return the JSON for a specific dataset
Return JSON for Buttercup Games's Client_errors dataset.
| datamodel Tutorial Client_errors
4. Run a search on a specific dataset
Run the search for Buttercup Games's Client_errors.
| datamodel Tutorial Client_errors search
5. Run a search on a dataset for specific criteria
Search Buttercup Games's Client_errors dataset for 404 errors and count the number of events.
| datamodel Tutorial Client_errors search | search Tutorial.status=404 | stats count
6. For an accelerated data model, reveal what data has been summarized over a selected time range
After the Tutorial data model is accelerated, this search uses the
summariesonly argument in conjunction with
timechart to reveal what data has been summarized for the Client_errors dataset over a selected time range.
| datamodel Tutorial summariesonly=true search | timechart span=1h count
This documentation applies to the following versions of Splunk® Enterprise: 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 9.0.0