All Apps and Add-ons

Splunk new Datasets feature

realsplunk
Motivator

Hello guys,

could you explain me differences between data models and datasets?

It seems Pivot reports are based either on datamodels or datasets but both look similar?

In V6.5 : are pivot reports now based on tables instead of data models?

Thanks for the clarification.

0 Karma
1 Solution

mattness
Splunk Employee
Splunk Employee

In 6.5 there was a terminology change. The term "data model object" was replaced by "data model dataset." Nothing about the functionality actually changed. Splunk is just clarifying that data models are in fact made up of hierarchies of datasets.

Nothing has changed for Pivot with regard to how it works with data models except for this terminology change. Previous to 6.5, you had to select a data model object and open it in Pivot. Now you select a data model dataset and open it in Pivot.

The concept of datasets was formally introduced in 6.5. You can use the new datasets functionality to work with three new dataset types. Two of these types already existed as knowledge objects: lookups and data model datasets. The third type, table datasets, is new to Splunk.

For more information about dataset types, see http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Aboutdatasets

One difference for Pivot now is that any dataset type can be opened in Pivot. You can do this from the Datasets listing page. For more information see http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Workwithdatasets#Open_a_dataset_in_Pivot

View solution in original post

mattness
Splunk Employee
Splunk Employee

In 6.5 there was a terminology change. The term "data model object" was replaced by "data model dataset." Nothing about the functionality actually changed. Splunk is just clarifying that data models are in fact made up of hierarchies of datasets.

Nothing has changed for Pivot with regard to how it works with data models except for this terminology change. Previous to 6.5, you had to select a data model object and open it in Pivot. Now you select a data model dataset and open it in Pivot.

The concept of datasets was formally introduced in 6.5. You can use the new datasets functionality to work with three new dataset types. Two of these types already existed as knowledge objects: lookups and data model datasets. The third type, table datasets, is new to Splunk.

For more information about dataset types, see http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Aboutdatasets

One difference for Pivot now is that any dataset type can be opened in Pivot. You can do this from the Datasets listing page. For more information see http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Workwithdatasets#Open_a_dataset_in_Pivot

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!