Splunk® Light

Getting Started Manual

Download manual as PDF

Download topic as PDF

View and manage data models in Splunk Light

The Data Models management page is where you go to create data models and maintain some of their "higher order" aspects such as permissions and acceleration. On this page you can:

  • Create a new data model - It's as easy as clicking a button.
  • Set permissions - Data models are knowledge objects and as such are permissionable. You use permissions to determine who can see and update the data model.
  • Enable data model acceleration - This can speed up Pivot performance for data models that cover large datasets.
  • Clone data models - Useful for quick creation of new data models that are based on existing data models, or to copy data models into other apps.
  • Upload and download data models - Download a data model (export it outside of Splunk). Upload an exported data model into a different Splunk implementation.
  • Delete data models - Remove data models that are no longer useful.

In this topic, we'll discuss these aspects of data model management. When you need to define the dataset hierarchies that make up a data model, you go to the Data Model Editor. See Design data models in Splunk Light in this manual.

Navigating to the Data Models management page

The Data Models management page is essentially a listing page, similar to the Alerts, Reports, and Dashboards listing pages. It enables management of permissions and acceleration and also enables data model cloning and removal. It is different from the Select a Data Model page that you may see when you first enter Pivot (you'll only see it if you have more than one data model), as that page exists only to enable Pivot users to choose the data model they wish to use for pivot creation.

The Data Models management page lists all of the data models in your system in a paginated table. This table can be filtered by app, owner, and name. It can also display all data models that are visible to users of a selected app or just show those data models that were actually created within the app.

See About datasets in Splunk Light in this manual for more information about datasets.

There are two ways to get to the Data Models management page:

Through the sidebar menu in Splunk Light

In the sidebar menu, navigate to Knowledge > Data models.

Through the Datasets listing page

  1. In the menu bar, open the Datasets listing page.
  2. Locate a data model dataset.
  3. (Optional) Click the name of the data model dataset to view it in the dataset viewing page.
  4. Select Manage > Edit Data Model for that dataset.
  5. On the Data Model Editor, click All Data Models to go to the Data Models management page.

Create a new data model

Prerequisites

You can only create data models if your permissions enable you to do so. Your role must have the ability to write to at least one app. If your role has insufficient permissions the New Data Model button will not appear.

See Enable roles to create data models in this topic.

Steps

  1. Navigate to the Data Models management page.
  2. Click New Data Model to create a new data model.
  3. Enter the data model Title.
    The Title field can accept any character except asterisks. It can also accept blank spaces between characters.
    The data model ID field fills in as you enter the title. Do not update it. The data model ID must be a unique identifier for the data model. It can only contain letters, numbers, and underscores. Spaces between characters are also not allowed. After you click Create you cannot change the ID value.
  4. (Optional) Enter the data model Description.
  5. (Optional) Change the App value if you want the data model to belong to a different app context. App displays app context that you are in currently.
  6. Click Create to open the new data model in the Data Model Editor, where you can begin adding and defining the datasets that make up the data model. 7.1 create new model.png


When you first enter the Data Model Editor for a new data model it will not have any datasets. To define the data model's first dataset, click Add Dataset and select a dataset type. For more information about dataset definition, see the following sections on adding field, search, transaction, and child datasets.

For all the details on the Data Model Editor and the work of creating data model datasets, see Design data models in Splunk Light in this manual.

Enable roles to create data models

By default, only users with the admin or power role can create data models. For other users, the ability to create a data model is tied to whether their roles have "write" access to an app. To grant another role write access to an app, follow these steps.

Steps

  1. Click the App dropdown at the top of the page and select Manage Apps to go to the Apps page.
  2. On the Apps page, find the app that you want to grant data model creation permissions for and click Permissions.
  3. On the Permissions page for the app, select Write for the roles that should be able to create data models for the app.
  4. Click Save to save your changes.

Giving roles the ability to create data models can have other implications.

See Disable or delete knowledge objects in the Splunk Enterprise Knowledge Manager Manual.

About data model permissions

Data models are knowledge objects, and as such the ability to view and edit them is governed by role-based permissions. When you first create a data model it is private to you, which means that no other user can view it on the Select a Data Model page or Data Models management page or update it in any way.

If you want to accelerate a data model, you need to share it first. You cannot accelerate private data models. See Enable data model acceleration in the Splunk Enterprise Knowledge Manager Manual.

Align data model permissions with those of related knowledge objects

When you share a data model the knowledge objects associated with that data model (such as lookups or field extractions) must have the same permissions. Otherwise, people may encounter errors when they use the data model.

For example, if your data model is shared to all users of the Search app but uses a lookup table and lookup definition that is only shared with users that have the Admin role, everything will work fine for Admin role users, but all other users will get errors when they try to use the data model in Pivot. The solution is either to restrict the data model to Admin users or to share the lookup table and lookup definition to all users of the Search app.

Edit the permissions for a data model

Prerequisites

Steps

  1. Go to the Data Models management page.
  2. Locate the data model that you want to edit permissions for. Use one of the following options.
    Option Additional steps for this option
    Select Edit > Edit Permissions. None
    Expand the row for the dataset. Click Edit for permissions.
  3. Edit the dataset permissions and click Save to save your changes.

This brings up the Edit Permissions dialog, which you can use to share private data models with others, and to determine the access levels that various roles have to the data models.

PREVIOUS
About data models in Splunk Light
  NEXT
Design data models in Splunk Light

This documentation applies to the following versions of Splunk® Light: 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.3.0, 7.3.1


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters