The differences between event-based data model objects and search-based data model objects are defined in the documentation here (for a high-level overview) and here (for a more detailed discussion).
Essentially, root event objects are defined by "constraints" (simple searches, no "|" characters or complicated search commands), while root search objects are defined by full searches that can involve any kind of complex search construction. All child objects are defined by constraints, on top of whatever they've inherited from their parent objects.
In general, you should try to use event-based objects when possible, in large part because they can benefit from search acceleration while search base objects cannot. For more information read this.
As for field names (or in this case attribute names--fields are called "attributes" when used in data models), auto-extracted attribute names should never have spaces. The only characters recognized by Splunk for field names are a-z, A-Z, 0-9, or _. If you've configured field extractions in props.conf or transforms.conf where the field names include spaces, that will cause problems down the line. Usually a process called "key cleaning" corrects this by putting underscores in where spaces exist, but you may have it disabled for these particular fields for some reason. For details on field name syntax see this documentation.
Once you've got the fields extracted correctly with underscores instead of spaces you can rename them however you want in the Data Model editor or Pivot editor. For example, if you have an auto-extracted attribute named Emp_ID you can rename it as Emp ID in the attribute defintion. But you shouldn't have an auto-extracted attribute that is initially named Emp ID -- renaming it to Emp_ID in the attribute defintion won't help it to work in the Data Model Editor.
For more information about attributes see: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Designdatamodelobjects#Manage_object_at...
