How to see all the data model that I can access as a user?

[splunkos]

Hello!

I am a user and I have access to https://myorg.splunkcloud.com/en-US/app/myapp/search

I would like to see:

1) what fields and tables I can query (I have access to)

2) what data modelling exists (how tables relate and are joined)

3) some unique values of some of these fields

If I can run SQL, it would be great for example! Otherwise, what is the proper way?

My goal is to run a query to return values of some fields applying some filters, the typical stuff! 🙂

Thanks!

[VatsalJagani]

@splunkos - Below is answers to your questions:

1) what fields and tables I can query (I have access to)

• In Splunk its rather called "Index". Moreover, Splunk has other field called "sourcetype" to categorize the data.
• Below is the query you can use to get which data you have access to.
• | tstats count where index=* by index, sourcetype

2) what data modelling exists (how tables relate and are joined)

• In Splunk, go to "Settings" > "Data model" to see the details.

3) some unique values of some of these fields

• For specific data, you can see what fields exist along with its values
• index=<index-name> sourcetype=<sourcetype-name-if-you-know> | fieldsummary

If I can run SQL, it would be great for example! Otherwise, what is the proper way?

• The simple answer is NO.
• Think it as a different query language than SQL. But it's quite similar in terms of functions and commands it to be honest maybe even bit easier.

I hope this helps!!! Upvote if this helps!!!