All Apps and Add-ons

Searching The Web data using the Web data-model

Rakesh92
Engager

Hello Experts,

We tried to add the web data into the Web data model using the eventtypes and tags and I was successful in creating those to Normalize the data. I did the searched for the web data and saved it as eventtype in eventtypes.conf in Splunk_SA_CIM/local/ and then in the tags.conf gave a tag for that eventtype to match data to data model using the tag.

My question here is do i need to give the tag name as 'Web' (The name of the data model) or create a child and like 'proxy' and give the tag name as proxy ?.

The other question is I'm trying to test if the data is linked to the data model.

I used a search [|datamodel Web]

The result is as follows, It is showing the structure of the datamodel.

{ [-]
description: Web Data Model

displayName: Web

modelName: Web

objectNameList: [ [-]
Web

Proxy

zscaler

]

objectSummary: { [-]
Event-Based: 3

Search-Based: 0

Transaction-Based: 0

}

objects: [ [+]
]

}

Show as raw text

When I tried to search [|datamodel Web proxy search]

It is shown there is no result found.

Please help me giving the write tag in tags.conf to link data to the datamodel and searching the data using that datamodel

0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi @Rakesh92,

When you assign tag to eventtype for Web datamodel you need to provide tag web because Web datamodel using (cim_Web_indexes) tag=web in Base search. If you want to search proxy data then you need to assign proxy tag as well to eventtype which you created.

Now when you search using splunk query |datamodel Web, it will give you datamodel structure only. When you want to search data from Web datamodel, you need to run query |datamodel Web Web search. After running this query if you will still not get any result then you need to check cim_Web_indexes macro to add/modify index list based on your requirement.

I hope this helps.

Thanks,
Harshil

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi @Rakesh92,

When you assign tag to eventtype for Web datamodel you need to provide tag web because Web datamodel using (cim_Web_indexes) tag=web in Base search. If you want to search proxy data then you need to assign proxy tag as well to eventtype which you created.

Now when you search using splunk query |datamodel Web, it will give you datamodel structure only. When you want to search data from Web datamodel, you need to run query |datamodel Web Web search. After running this query if you will still not get any result then you need to check cim_Web_indexes macro to add/modify index list based on your requirement.

I hope this helps.

Thanks,
Harshil

Rakesh92
Engager

Hi Harshil,,

That really Helped, Actually the macro was empty that the reason I didn't see any data. Once I added the index to the macro that worked. Thanks A lot 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...