Returns a string array of the field names of this data model object's calculations, and the names of this data model object's fields.
Returns a string array of the field names of this data model object's calculations, and the names of this data model object's fields.
An array of strings with the field names of this
data model object's calculations, and the names of fields on
this data model object.
allFieldNames: function() {
return Object.keys(this.allFields());
},Returns an array of data model fields from this data model object's calculations, and this data model object's fields.
An array of splunk.Service.DataModelField objects
which includes this data model object's fields, and the fields from
this data model object's calculations.
allFields: function() {
// merge fields and calculatedFields()
var combinedFields = [];
for (var f in this.fields) {
if (this.fields.hasOwnProperty(f)) {
combinedFields[f] = this.fields[f];
}
}
var calculatedFields = this.calculatedFields();
for (var cf in calculatedFields) {
if (calculatedFields.hasOwnProperty(cf)) {
combinedFields[cf] = calculatedFields[cf];
}
}
return combinedFields;
},Returns a string array of the field names of this data model object's calculations.
An array of strings with the field names of this
data model object's calculations.
calculatedFieldNames: function() {
return Object.keys(this.calculatedFields());
},Returns an array of data model fields from this data model object's calculations.
An array of splunk.Service.DataModelField objects
of the fields from this data model object's calculations.
calculatedFields: function(){
var fields = {};
// Iterate over the calculations, get their fields
var keys = this.calculationIDs();
var calculations = this.calculations;
for (var i = 0; i < keys.length; i++) {
var calculation = calculations[keys[i]];
for (var f = 0; f < calculation.outputFieldNames().length; f++) {
fields[calculation.outputFieldNames()[f]] = calculation.outputFields[calculation.outputFieldNames()[f]];
}
}
return fields;
},Returns a string array of the IDs of this data model object's calculations.
An array of strings with the IDs of this data model
object's calculations.
calculationIDs: function() {
return Object.keys(this.calculations);
},Local acceleration is tsidx acceleration of a data model object that is handled manually by a user. You create a job which generates an index, and then use that index in your pivots on the data model object.
The namespace created by the job is 'sid={sid}' where {sid} is the job's sid. You would use it in another job by starting your search query with | tstats ... from sid={sid} | ...
The tsidx index created by this job is deleted when the job is garbage collected by Splunk.
It is the user's responsibility to manage this job, including cancelling it.
| Name | Type | Description |
|---|---|---|
| earliestTime | String | A time modifier (e.g., "-2w") setting the earliest time to index. |
| callback | Function | A function to call with the search job: |
service.dataModels().fetch(function(err, dataModels) {
var object = dataModels.item("some_data_model").objectByName("some_object");
object.createLocalAccelerationJob("-1d", function(err, accelerationJob) {
console.log("The job has name:", accelerationJob.name);
});
});
createLocalAccelerationJob: function(earliestTime, callback) {
// If earliestTime parameter is not specified, then set callback to its value
if (!callback && utils.isFunction(earliestTime)) {
callback = earliestTime;
earliestTime = undefined;
}
var query = "| datamodel \"" + this.dataModel.name + "\" " + this.name + " search | tscollect";
var args = earliestTime ? {earliest_time: earliestTime} : {};
this.dataModel.service.search(query, args, callback);
},Returns a new Pivot Specification, accepts no parameters.
A new pivot specification.
createPivotSpecification: function() {
// Pass in this DataModelObject to create a PivotSpecification
return new root.PivotSpecification(this);
}
});Returns a data model field instance, representing a field on this data model object.
The data model field
from this data model object with the specified name, null if it the
field by that name doesn't exist.
fieldByName: function(name) {
return this.calculatedFields()[name] || this.fields[name] || null;
},Returns a string array of the names of this data model object's fields.
An array of strings with the field names of this
data model object.
fieldNames: function() {
return Object.keys(this.fields);
},Returns whether this data model object contains the field with the name passed in the fieldName parameter.
| Name | Type | Description |
|---|---|---|
| fieldName | String | The name of the field to look for. |
True if this data model contains the field by name.
hasField: function(fieldName) {
return utils.contains(this.allFieldNames(), fieldName);
},Constructor for a data model object. SDK users are not expected to invoke this constructor directly.
| Name | Type | Description |
|---|---|---|
| props | Object | A dictionary of properties to set: |
| parentDataModel | splunkjs.Service.DataModel | The |
init: function(props, parentDataModel) {
props = props || {};
props.owner = props.owner || "";
this.dataModel = parentDataModel;
this.name = props.objectName;
this.displayName = props.displayName;
this.parentName = props.parentName;
this.lineage = props.lineage.split(".");
// Properties exclusive to BaseTransaction
if (props.hasOwnProperty("groupByFields")) {
this.groupByFields = props.groupByFields;
}
if (props.hasOwnProperty("objectsToGroup")) {
this.objectsToGroup = props.objectsToGroup;
}
if (props.hasOwnProperty("transactionMaxTimeSpan")) {
this.maxSpan = props.transactionMaxTimeSpan;
}
if (props.hasOwnProperty("transactionMaxPause")) {
this.maxPause = props.transactionMaxPause;
}
// Property exclusive to BaseSearch
if (props.hasOwnProperty("baseSearch")) {
this.baseSearch = props.baseSearch;
}
// Parse fields
this.fields = {};
for (var i = 0; i < props.fields.length; i++) {
this.fields[props.fields[i].fieldName] = new root.DataModelField(props.fields[i]);
}
// Parse constraints
this.constraints = [];
for (var j = 0; j < props.constraints.length; j++) {
this.constraints.push(new root.DataModelConstraint(props.constraints[j]));
}
// Parse calculations
this.calculations = [];
for (var k = 0; k < props.calculations.length; k++) {
this.calculations[props.calculations[k].calculationID] = new root.DataModelCalculation(props.calculations[k]);
}
},Is this data model object a BaseSearch?
Whether this data model object is the root type, BaseSearch.
isBaseSearch: function() {
return !utils.isUndefined(this.baseSearch);
},Is this data model object is a BaseTransaction?
Whether this data model object is the root type, BaseTransaction.
isBaseTransaction: function() {
return !utils.isUndefined(this.maxSpan);
},Returns the data model object this one inherits from if it is a user defined, otherwise return null.
This data model object's parent
or null if this is not a user defined data model object.
parent: function() {
return this.dataModel.objectByName(this.parentName);
},Start a search job that applies querySuffix to all the events in this data model object.
| Name | Type | Description |
|---|---|---|
| params | Object | A dictionary of properties for the search job. For a list of available parameters, see Search job parameters on Splunk Developer Portal. |
| querySuffix | String | A search query, starting with a '|' that will be appended to the command to fetch the contents of this data model object (e.g., "| head 3"). |
| callback | Function | A function to call with the search job: |
service.dataModels().fetch(function(err, dataModels) {
var object = dataModels.item("internal_audit_logs").objectByName("searches");
object.startSearch({}, "| head 5", function(err, job) {
console.log("The job has name:", job.name);
});
});
startSearch: function(params, querySuffix, callback) {
var query = "| datamodel " + this.dataModel.name + " " + this.name + " search";
// Prepend a space to the querySuffix, or set it to an empty string if null or undefined
querySuffix = (querySuffix) ? (" " + querySuffix) : ("");
this.dataModel.service.search(query + querySuffix, params, callback);
},