Auditing Datamodels

[zekiramhi]

Hello,

Is there a way to validate the fields used in the datamodel by how compliant they are with the current setup?
I am trying to validate and fix data models to receive optimum results in the Splunk ES.

Any tips regarding the issue will be appreciated,
Thanks

[lakshman239]

if you are happy with the answers provided and/or your issue resolved, can you pls accept the response to close tracking on this?

[zekiramhi]

Sure, Sorry im new to Splunk Answers.

[skalliger]

There is also the function fieldsummary.

[lakshman239 · Accepted solution]

Would this help? https://docs.splunk.com/Documentation/ES/5.2.2/Admin/Dashboardrequirements

Also, for e.g. You can use | from datamodel "Authentication.Authentication" | fieldsummary for Authentication datamodel to check if all the datamodel fields are mapped and check the valued to see if they are related to your datasource.

[zekiramhi]

Fantastic, Exactly what I needed. Thanks!

[adonio]

try this app
https://splunkbase.splunk.com/app/2968/