Reporting

When should a data model be created. What is the criteria for doing so?

kamal_jagga
Contributor

Hi,

When should a data model be created. What is the criteria for doing so ?

I am running the following search almost 15 times in different panels in the same dashboard with just difference of the search group.

Should i create a data model for this?

If yes, how and what should be the the objects and other constraints of the datamodel.

Search:

index=cricket_idx |rex field=_raw max_match=0 "\{\d.\d\,(?P<SERVICE>.*?)\,(?:\{|\})"
|stats count by SERVICE 
|rex field=SERVICE "(?P<SERVICE_NAME>.*?)\,.*?(?P<STATUS>F|SE)\,(?P<RESPONSE>\d+)" 
|eval Failed=if(STATUS!="S",count,0) |stats  avg(RESPONSE) by SERVICE_NAME
Tags (1)
0 Karma

stephanefotso
Motivator

Hello! You will find all you need here: http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Aboutdatamodels
Thanks

SGF

kamal_jagga
Contributor

Thanks for the reply.

I have read that document already but its not quite clear (sorry i am newbie).

Would you be able to explain the above things in maybe 2 lines each in simple language.

Thanks

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...