Reporting

Datamodel and Pivot export with App

rjain15
Explorer

Hi

If I create a datamodel and pivot, can I export it and bundle it with an app?

What are the files created and how can I bundle it with the app?

thanks,
Rajesh

0 Karma

mattness
Splunk Employee
Splunk Employee

Data models are stored on disk as JSON files, and they have associated configs in datamodels.conf and metadata in local.meta (for models that you create) and default.meta (for models delivered with the product).

Models that you create are stored in <yourapp>/local/data/models while models delivered with the product can be found in <myapp>/default/data/models.

Currently there's no easy way to export data models from one app to another; you'll have to do it by hand, which means at least copying over the JSON file and the related stanza in datamodels.conf. You should also move over the related local.meta material for the datamodel as well.

If you no longer want to see the data model in the originating app you should delete the data model from that app via the UI (or, by hand, delete the JSON file and remove the related stanza in datamodels.conf).

For more information see http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managedatamodels#Manual_data_model_mana...

As for pivots, to export them save them as a report; this will create a stanza in savedsearches.conf which you can copy over to the savedsearches.conf for your new app. You'll want to do this after you move the data model over, of course.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...