JDBC Driver for Splunk

Build 22.0.8462

Datasets

Create, query, update, and delete datasets in Splunk.

Select

The Datasets table requires DataModelId in the WHERE clause. The DataModelId column supports server-side processing for the = operator. The driver processes other search criteria client-side within the driver.

SELECT * FROM DataSets  WHERE DataModelId = 'SampleModel' 
You can turn off the client-side execution of the query by setting SupportEnhancedSQL to false in which case any search criteria that refers to other columns will cause an error or inconsistent data.

Insert

Splunk allows inserts only when DataModelId, ParentName, and ObjectName are all specified.

INSERT INTO  [Datasets] (ObjectName, ParentName, DataModelId) VALUES ('SampleSet', 'BaseEvent','SampleModel')

Update

The Datasets table allows updates when DataModelId is specified. The columns that can be updated in this case are the following: Description and DisplayName.

When ObjectName is also specified, you can update the following columns: ObjectDisplayName, ParentName, Comment, Fields, Calculations, Constraints, Lineage, ObjectSearchNoFields, ObjectSearch, AutoextractSearch, PreviewSearch, AccelerationSearch, BaseSearch, and TsidxNamespace.

UPDATE Datasets SET Description = 'model description' , DisplayName = 'Model Display Name' WHERE DataModelId = 'SampleModel' 

UPDATE Datasets SET ParentName = 'BaseEvent', BaseSearch = '| search (index=* OR index=_*) | fields _time, RootObject', AccelerationSearch = ' search (index=* OR index=_*) ' WHERE DataModelId = 'SampleModel' AND ObjectName = 'SampleSet' 

Delete

Datasets can be deleted by providing the DataModelId and the ObjectName of the dataset.

DELETE FROM Datasets WHERE DataModelId = 'SampleModel' AND ObjectName = 'SampleSet'

Columns

Name Type ReadOnly References Description
ObjectName [KEY] String False

Name of the dataset object.

DatamodelId [KEY] String False

DataModels.Id

Id of the data model the object belongs to.

DisplayName String False

Name of the data model the object belongs to.

Description String False

Dataset description.

ObjectNameList String True

List of the objects in the data model.

ObjectDisplayName String False

Name displayed in Splunk for the object.

ParentName String False

Name of the Parent Event.

Comment String False

Dataset comments.

Fields String False

Dataset events indexed fields.

Calculations String False

Saved calculations for dataset fields.

Constraints String False

Saved constraints for dataset fields.

Lineage String False

Dataset lineage.

ObjectSearchNoFields String False

Object search query without fields.

ObjectSearch String False

Saved search query for the object.

AutoextractSearch String False

Search query for autoextraction.

PreviewSearch String False

Search preview query.

AccelerationSearch String False

Search query including acceleration.

BaseSearch String False

Basic search query.

TsidxNamespace String False

Allocated namespace.

EventBased Integer True

Number of Event-Based objects in the data model.

TransactionBased Integer True

Number of Transaction-Based objects in the data model.

SearchBased Integer True

Number of Search-Based objects in the data model.

Copyright (c) 2023 CData Software, Inc. - All rights reserved.
Build 22.0.8462