Reporting

Datamodel and Pivot export with App

rjain15
Explorer

Hi

If I create a datamodel and pivot, can I export it and bundle it with an app?

What are the files created and how can I bundle it with the app?

thanks,
Rajesh

0 Karma

mattness
Splunk Employee
Splunk Employee

Data models are stored on disk as JSON files, and they have associated configs in datamodels.conf and metadata in local.meta (for models that you create) and default.meta (for models delivered with the product).

Models that you create are stored in <yourapp>/local/data/models while models delivered with the product can be found in <myapp>/default/data/models.

Currently there's no easy way to export data models from one app to another; you'll have to do it by hand, which means at least copying over the JSON file and the related stanza in datamodels.conf. You should also move over the related local.meta material for the datamodel as well.

If you no longer want to see the data model in the originating app you should delete the data model from that app via the UI (or, by hand, delete the JSON file and remove the related stanza in datamodels.conf).

For more information see http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managedatamodels#Manual_data_model_mana...

As for pivots, to export them save them as a report; this will create a stanza in savedsearches.conf which you can copy over to the savedsearches.conf for your new app. You'll want to do this after you move the data model over, of course.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...