Splunk ES depends heavily on the Common Information Model, which grants you some options in terms of what will be included.
There are predefined tags that are used to associate events with the datamodel it should belong to. If your sourcetypes don't set this tag, they won't be part of the datamodel. Many of the official TAs set the tags and other fields appropriately to be CIM compliant, so if you have these in place all of the events handled by those apps would already be tagged to be a part of the datamodel.
Another option is to use the CIM-provided macros to more finely tune which events should be a part of its datamodels. The macros are named cim_<datamodel>_indexes, but they are general macros and could really contain event search (you can't include |, though).
So for instance, the Web datamodel has this macro:
[cim_Web_indexes]
definition = ()
If you knew that you only wanted to include the apache sourcetype, you could set it to this:
[cim_Web_indexes]
definition = (sourcetype=apache)
Note that although I mentioned that ES relies heavily on the CIM, nothing prevents ES from using non-datamodel searches, and if you have any correlation searches that don't use the datamodel, you'd have to determine how you want to filter those when you create them. You would also need to take the sourcetypes into consideration when crafting your drilldown searches, which are almost always against raw data, which means the CIM macros wouldn't be in effect.
