Splunk Cloud

Search Reference

Download manual as PDF

Download topic as PDF

datamodel

Description

Examine and search data model datasets.

Use the datamodel command to return the JSON for all or a specified data model and its datasets. You can also search against the specified data model or a dataset within that datamodel.

A data model is a hierarchically-structured search-time mapping of semantic knowledge about one or more datasets. A data model encodes the domain knowledge necessary to build a variety of specialized searches of those datasets. For more information, see About data models and Design data models in the Knowledge Manager Manual.

The datamodel search command lets you search existing data models and their datasets from the search interface.

The datamodel command is a generating command and should be the first command in the search. Generating commands use a leading pipe character.

Syntax

| datamodel [<data model name>] [<dataset name>] [<data model search mode>] [allow_old_summaries=<bool>] [summariesonly=<bool>]

Required arguments

None

Optional arguments

data model name
Syntax: <string>
Description: The name of the data model to search. When only the data model is specified, the search returns the JSON for the single data model.
dataset name
Syntax: <string>
Description: The name of a data model dataset to search. Must be specified after the data model name. The search returns the JSON for the single dataset.
data model search mode
Syntax: <data model search result mode> | <data model search string mode>
Description: You can use datamodel to run a search against a data model or a data model dataset that returns either results or a search string. If you want to do this, you must provide a <data model search mode>. There are two <data model search mode> subcategories: modes that return results and modes that return search strings. See <data model search mode> options.
allow_old_summaries
Syntax: allow_old_summaries=<bool>
Description: This argument applies only to accelerated data models. When you change the constraints that define a data model but the Splunk software has not fully updated the summaries to reflect that change, the summaries may have some data that matches the old definition and some data that matches the new definition. By default, allow_old_summaries = false, which means that the search head does not use summary directories that are older than the new summary definition. This ensures that the datamodel search results always reflect your current configuration. When you set allow_old_summaries = false, datamodel uses both current summary data and summary data that was generated prior to the definition change. You can set allow_old_summaries=true in your search if you feel that the old summary data is close enough to the new summary data that its results are reliable.
Default: false
summariesonly
Syntax: summariesonly=<bool>
Description: This argument applies only to accelerated data models. When set to false, the datamodel search returns both summarized and unsummarized data for the selected data model. When set to true, the search returns results only from the data that has been summarized in TSIDX format for the selected data model. You can use this argument to identify what data is currently summarized for a given data model, or to ensure that a particular data model search runs efficiently.
Default: false

<data model search mode> options

data model search result mode
Syntax: search | flat | acceleration_search
Description: The modes for running searches on a data model or data model dataset that return results.
Mode Description
search Returns the search results exactly how they are defined.
flat Returns the same results as the search, except that it strips the hierarchical information from the field names. For example, where search mode might return a field named dmdataset.server, the field mode returns a field named server.
acceleration_search Runs the search that the search head uses to accelerate the data model. This mode works only on root event datasets and root search datasets that only use streaming commands.
data model search string mode
Syntax: search_string | flat_string | acceleration_search_string
Description: These modes return the strings for the searches that the Splunk software is actually running against the data model when it runs your SPL through the corresponding <data model search result mode>. For example, if you choose acceleration_search_string, the Splunk software returns the search string it would actually use against the data model when you run your SPL through acceleration_search mode.

Usage

The datamodel command is a report-generating command. See Command types.

Generating commands use a leading pipe character and should be the first command in a search.

Examples

1. Return the JSON for all data models

Return JSON for all data models available in the current app context.

| datamodel

This image shows the JSON for the built-in data models for the Search app.

2. Return the JSON for a specific datamodel

Return JSON for the Splunk's Internal Audit Logs - SAMPLE data model, which has the model ID internal_audit_logs.

| datamodel internal_audit_logs

This image shows the JSON for the internal audit logs, which is a built-in datamodel.

3. Return the JSON for a specific dataset

Return JSON for Buttercup Games's Client_errors dataset.

| datamodel Tutorial Client_errors

4. Run a search on a specific dataset

Run the search for Buttercup Games's Client_errors.

| datamodel Tutorial Client_errors search

5. Run a search on a dataset for specific criteria

Search Buttercup Games's Client_errors dataset for 404 errors and count the number of events.

| datamodel Tutorial Client_errors search | search Tutorial.status=404 | stats count

6. For an accelerated data model, reveal what data has been summarized over a selected time range

After the Tutorial data model is accelerated, this search uses the summariesonly argument in conjunction with timechart to reveal what data has been summarized for the Client_errors dataset over a selected time range.

| datamodel Tutorial summariesonly=true search | timechart span=1h count

See also

pivot

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has about using the datamodel command.

PREVIOUS
ctable
  NEXT
datamodelsimple

This documentation applies to the following versions of Splunk Cloud: 7.2.6, 7.1.3, 7.1.6, 7.2.3, 7.2.4


Comments

"from datamodel" and datamodel now actively remove extracted fields from the raw logs. See release notes: https://docs.splunk.com/Documentation/Splunk/7.1.0/Installation/AboutupgradingREADTHISFIRST#Data_model_searches_now_only_use_fields_that_have_been_defined_within_the_data_model
A VERY bad idea, as the raw logs from drilldowns can not be analyzed anymore, with their native fields missing. We requested to restore the old behavior (SPL-166843), but no idea if/when this will be done.
Meanwhile a partial workaround is to add "extract" to all your drilldowns to reextract the fields. But this will not help with calculated/looked up fields, therefore we replaced "from datamodel" in the drilldowns with a macro that does the extract and the necessary evals.
Also asset/identity investigator are harder to use because for any drilldown in there you have to add your macro manually.

Jonasmeier
April 5, 2019

The example that you give ("| datamodel Tutorial Client_errors search | search status=404 | stats count") used to work in the 6.? days but something was broken along the way such that the "|datamodel" command now works like the "| from datamodel" command in that ONLY the fields defined in the datamodel are available. It used to be that "|datamodel" gave all fields, so your example would work, but no longer. Yes, this means that the vast majority of ES drilldown searches are borked because most of them use "|datamodel".

Woodcock
November 14, 2018

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters