datamodel
Description
Examine and search data model datasets.
Use the datamodel
command to return the JSON for all or a specified data model and its datasets. You can also search against the specified data model or a dataset within that datamodel.
A data model is a hierarchically-structured search-time mapping of semantic knowledge about one or more datasets. A data model encodes the domain knowledge necessary to build a variety of specialized searches of those datasets. For more information, see About data models and Design data models in the Knowledge Manager Manual.
The datamodel
search command lets you search existing data models and their datasets from the search interface.
The datamodel
command is a generating command and should be the first command in the search. Generating commands use a leading pipe character.
Syntax
| datamodel [<data model name>] [<dataset name>] [<data model search mode>] [strict_fields=<bool>] [allow_old_summaries=<bool>] [summariesonly=<bool>]
Required arguments
None
Optional arguments
- data model name
- Syntax: <string>
- Description: The name of the data model to search. When only the data model is specified, the search returns the JSON for the single data model.
- dataset name
- Syntax: <string>
- Description: The name of a data model dataset to search. Must be specified after the data model name. The search returns the JSON for the single dataset.
- data model search mode
- Syntax: <data model search result mode> | <data model search string mode>
- Description: You can use
datamodel
to run a search against a data model or a data model dataset that returns either results or a search string. If you want to do this, you must provide a<data model search mode>
. There are two<data model search mode>
subcategories: modes that return results and modes that return search strings. See <data model search mode> options.
- allow_old_summaries
- Syntax: allow_old_summaries=<bool>
- Description: This argument applies only to accelerated data models. When you change the constraints that define a data model but the Splunk software has not fully updated the summaries to reflect that change, the summaries may have some data that matches the old definition and some data that matches the new definition. By default,
allow_old_summaries = false
, which means that the search head does not use summary directories that are older than the new summary definition. This ensures that thedatamodel
search results always reflect your current configuration. When you setallow_old_summaries = true
,datamodel
uses both current summary data and summary data that was generated prior to the definition change. You can setallow_old_summaries=true
in your search if you feel that the old summary data is close enough to the new summary data that its results are reliable. - Default: false
- summariesonly
- Syntax: summariesonly=<bool>
- Description: This argument applies only to accelerated data models. When set to false, the
datamodel
search returns both summarized and unsummarized data for the selected data model. When set to true, the search returns results only from the data that has been summarized in TSIDX format for the selected data model. You can use this argument to identify what data is currently summarized for a given data model, or to ensure that a particular data model search runs efficiently. - Default: false
- strict_fields
- Syntax: strict_fields=<bool>
- Description: Determines the scope of the
datamodel
search in terms of fields returned. Whenstrict_fields=true
, the search returns only default fields and fields that are included in the constraints of the specified data model dataset. Whenstrict_fields=false
, the search returns all fields defined in the data model, including fields inherited from parent data model datasets, extracted fields, calculated fields, and fields derived from lookups.
- You can also arrange for
strict_fields
to default tofalse
for a specific data model. See Design data models in the Knowledge Manager Manual. - Default: true
<data model search mode> options
- data model search result mode
- Syntax: search | flat | acceleration_search
- Description: The modes for running searches on a data model or data model dataset that return results.
Mode Description search
Returns the search results exactly how they are defined. flat
Returns the same results as the search
, except that it strips the hierarchical information from the field names. For example, wheresearch
mode might return a field nameddmdataset.server
, theflat
mode returns a field namedserver
.acceleration_search
Runs the search that the search head uses to accelerate the data model. This mode works only on root event datasets and root search datasets that only use streaming commands.
- data model search string mode
- Syntax: search_string | flat_string | acceleration_search_string
- Description: These modes return the strings for the searches that the Splunk software is actually running against the data model when it runs your SPL through the corresponding
<data model search result mode>
. For example, if you chooseacceleration_search_string
, the Splunk software returns the search string it would actually use against the data model when you run your SPL throughacceleration_search
mode.
Usage
The datamodel
command is a report-generating command. See Command types.
Generating commands use a leading pipe character and should be the first command in a search.
Examples
1. Return the JSON for all data models
Return JSON for all data models available in the current app context.
| datamodel
2. Return the JSON for a specific datamodel
Return JSON for the Splunk's Internal Audit Logs - SAMPLE data model, which has the model ID internal_audit_logs.
| datamodel internal_audit_logs
3. Return the JSON for a specific dataset
Return JSON for Buttercup Games's Client_errors dataset.
| datamodel Tutorial Client_errors
4. Run a search on a specific dataset
Run the search for Buttercup Games's Client_errors.
| datamodel Tutorial Client_errors search
5. Run a search on a dataset for specific criteria
Search Buttercup Games's Client_errors dataset for 404 errors and count the number of events.
| datamodel Tutorial Client_errors search | search Tutorial.status=404 | stats count
6. For an accelerated data model, reveal what data has been summarized over a selected time range
After the Tutorial data model is accelerated, this search uses the summariesonly
argument in conjunction with timechart
to reveal what data has been summarized for the Client_errors dataset over a selected time range.
| datamodel Tutorial summariesonly=true search | timechart span=1h count
See also
ctable | datamodelsimple |
This documentation applies to the following versions of Splunk Cloud Platform™: 9.2.2406, 8.2.2203, 9.0.2205, 8.2.2112, 8.2.2201, 8.2.2202, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403 (latest FedRAMP release)
Feedback submitted, thanks!