Why use data models instead of just having reports ?

[nikhilnsr1998]

Could someone please explain what are the scenarios where having a data-model would be important rather than using Reports ?

Until now i have been using scheduled reports to prepare data to be used in dashboard visuals but came across data models and am not able to understand the point since a reporting mechanism is already available.

[andrew_m_streic]

Data models are great for several things. The main thing is normalization of data. You can bring in different types of logs with different fields and search them using a set normalized field. For example. 3 different firewall might call the source ip differently. It might be called src_ip, client_ip, source_address. Using a data model you can search this using one standard name src.

[nikhilnsr1998]

will the data in the datamodels update like reports at regular intervals, such that the pivot will be updated in the dashboard with new data?

[richgalloway]

If the DM is accelerated then yes, definitely.

If the DM is not accelerated then the data is fetched at search time so, yes, it will be fresh.

[richgalloway]

Each has its place.

Scheduled reports do one thing.  They run a search at a scheduled time and save the results.  You can display those results, but that's about it.

Datamodels add structure to unstructured data.  That structure can be used by any query that needs to search the data covered by the DM.  Unlike a scheduled report, an unaccelerated DM does not use a search slot.