Knowledge Management

Data Models and SPL commands

JohnEGones
Communicator

Howdy all,

Perhaps someone can help me to remember the SPL query that lists out the datasets as fields in the data model.

It's something like:

 

| datamodel SomeDataModel accelerate....(i dont remember the rest and cant find the relevant notes I had)

 



Thanks in advance.

Labels (1)
Tags (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

You can call the

| datamodel <your_datamodel> [<root_node>] acceleration_search_string

command to see what search is used to generate the search used to accelerate the datamodel if that's what you want.

View solution in original post

JohnEGones
Communicator

The Rickest Dill around! Thank you!

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You can call the

| datamodel <your_datamodel> [<root_node>] acceleration_search_string

command to see what search is used to generate the search used to accelerate the datamodel if that's what you want.

Get Updates on the Splunk Community!

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...

What’s New in Splunk Observability Cloud: January Feature Highlights & Deep Dives

Splunk Observability Cloud continues to evolve, empowering engineering and operations teams with advanced ...