Reporting

Datamodel and Pivot export with App

rjain15
Explorer

Hi

If I create a datamodel and pivot, can I export it and bundle it with an app?

What are the files created and how can I bundle it with the app?

thanks,
Rajesh

0 Karma

mattness
Splunk Employee
Splunk Employee

Data models are stored on disk as JSON files, and they have associated configs in datamodels.conf and metadata in local.meta (for models that you create) and default.meta (for models delivered with the product).

Models that you create are stored in <yourapp>/local/data/models while models delivered with the product can be found in <myapp>/default/data/models.

Currently there's no easy way to export data models from one app to another; you'll have to do it by hand, which means at least copying over the JSON file and the related stanza in datamodels.conf. You should also move over the related local.meta material for the datamodel as well.

If you no longer want to see the data model in the originating app you should delete the data model from that app via the UI (or, by hand, delete the JSON file and remove the related stanza in datamodels.conf).

For more information see http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managedatamodels#Manual_data_model_mana...

As for pivots, to export them save them as a report; this will create a stanza in savedsearches.conf which you can copy over to the savedsearches.conf for your new app. You'll want to do this after you move the data model over, of course.

Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...