Knowledge Management

Data Models and SPL commands

JohnEGones
Communicator

Howdy all,

Perhaps someone can help me to remember the SPL query that lists out the datasets as fields in the data model.

It's something like:

 

| datamodel SomeDataModel accelerate....(i dont remember the rest and cant find the relevant notes I had)

 



Thanks in advance.

Labels (1)
Tags (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

You can call the

| datamodel <your_datamodel> [<root_node>] acceleration_search_string

command to see what search is used to generate the search used to accelerate the datamodel if that's what you want.

View solution in original post

JohnEGones
Communicator

The Rickest Dill around! Thank you!

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You can call the

| datamodel <your_datamodel> [<root_node>] acceleration_search_string

command to see what search is used to generate the search used to accelerate the datamodel if that's what you want.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...