<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Why use data models instead of just having reports ? in Knowledge Management</title>
    <link>https://community.splunk.com/t5/Knowledge-Management/Why-use-data-models-instead-of-just-having-reports/m-p/568451#M8513</link>
    <description>&lt;P&gt;will the data in the datamodels update like reports at regular intervals, such that the pivot will be updated in the dashboard with new data?&lt;/P&gt;</description>
    <pubDate>Fri, 24 Sep 2021 23:16:21 GMT</pubDate>
    <dc:creator>nikhilnsr1998</dc:creator>
    <dc:date>2021-09-24T23:16:21Z</dc:date>
    <item>
      <title>Why use data models instead of just having reports ?</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Why-use-data-models-instead-of-just-having-reports/m-p/568335#M8511</link>
      <description>&lt;P&gt;Could someone please explain what are the scenarios where having a data-model would be important rather than using Reports ?&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Until now i have been using scheduled reports to prepare data to be used in dashboard visuals but came across data models and am not able to understand the point since a reporting mechanism is already available.&lt;/P&gt;</description>
      <pubDate>Fri, 24 Sep 2021 07:20:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Why-use-data-models-instead-of-just-having-reports/m-p/568335#M8511</guid>
      <dc:creator>nikhilnsr1998</dc:creator>
      <dc:date>2021-09-24T07:20:22Z</dc:date>
    </item>
    <item>
      <title>Re: Why use data models instead of just having reports ?</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Why-use-data-models-instead-of-just-having-reports/m-p/568421#M8512</link>
      <description>&lt;P&gt;Each has its place.&lt;/P&gt;&lt;P&gt;Scheduled reports do one thing.&amp;nbsp; They run a search at a scheduled time and save the results.&amp;nbsp; You can display those results, but that's about it.&lt;/P&gt;&lt;P&gt;Datamodels add structure to unstructured data.&amp;nbsp; That structure can be used by any query that needs to search the data covered by the DM.&amp;nbsp; Unlike a scheduled report, an unaccelerated DM does not use a search slot.&lt;/P&gt;</description>
      <pubDate>Fri, 24 Sep 2021 17:46:23 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Why-use-data-models-instead-of-just-having-reports/m-p/568421#M8512</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2021-09-24T17:46:23Z</dc:date>
    </item>
    <item>
      <title>Re: Why use data models instead of just having reports ?</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Why-use-data-models-instead-of-just-having-reports/m-p/568451#M8513</link>
      <description>&lt;P&gt;will the data in the datamodels update like reports at regular intervals, such that the pivot will be updated in the dashboard with new data?&lt;/P&gt;</description>
      <pubDate>Fri, 24 Sep 2021 23:16:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Why-use-data-models-instead-of-just-having-reports/m-p/568451#M8513</guid>
      <dc:creator>nikhilnsr1998</dc:creator>
      <dc:date>2021-09-24T23:16:21Z</dc:date>
    </item>
    <item>
      <title>Re: Why use data models instead of just having reports ?</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Why-use-data-models-instead-of-just-having-reports/m-p/568452#M8514</link>
      <description>&lt;P&gt;If the DM is accelerated then yes, definitely.&lt;/P&gt;&lt;P&gt;If the DM is not accelerated then the data is fetched at search time so, yes, it will be fresh.&lt;/P&gt;</description>
      <pubDate>Fri, 24 Sep 2021 23:54:02 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Why-use-data-models-instead-of-just-having-reports/m-p/568452#M8514</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2021-09-24T23:54:02Z</dc:date>
    </item>
    <item>
      <title>Re: Why use data models instead of just having reports ?</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Why-use-data-models-instead-of-just-having-reports/m-p/568583#M8515</link>
      <description>&lt;P&gt;Data models are great for several things. The main thing is normalization of data. You can bring in different types of logs with different fields and search them using a set normalized field. For example. 3 different firewall might call the source ip differently. It might be called src_ip, client_ip, source_address. Using a data model you can search this using one standard name src.&lt;/P&gt;</description>
      <pubDate>Mon, 27 Sep 2021 16:57:07 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Why-use-data-models-instead-of-just-having-reports/m-p/568583#M8515</guid>
      <dc:creator>andrew_m_streic</dc:creator>
      <dc:date>2021-09-27T16:57:07Z</dc:date>
    </item>
  </channel>
</rss>

