Datasets

Create, query, update, and delete datasets in Splunk.

Select

The Datasets table requires DataModelId in the WHERE clause. The DataModelId column supports server-side processing for the = operator. The driver processes other search criteria client-side within the driver.

SELECT * FROM DataSets  WHERE DataModelId = 'SampleModel'

You can turn off the client-side execution of the query by setting SupportEnhancedSQL to false in which case any search criteria that refers to other columns will cause an error or inconsistent data.

Insert

Splunk allows inserts only when DataModelId, ParentName, and ObjectName are all specified.

INSERT INTO  [Datasets] (ObjectName, ParentName, DataModelId) VALUES ('SampleSet', 'BaseEvent','SampleModel')

Update

The Datasets table allows updates when DataModelId is specified. The columns that can be updated in this case are the following: Description and DisplayName.

When ObjectName is also specified, you can update the following columns: ObjectDisplayName, ParentName, Comment, Fields, Calculations, Constraints, Lineage, ObjectSearchNoFields, ObjectSearch, AutoextractSearch, PreviewSearch, AccelerationSearch, BaseSearch, and TsidxNamespace.

UPDATE Datasets SET Description = 'model description' , DisplayName = 'Model Display Name' WHERE DataModelId = 'SampleModel' 

UPDATE Datasets SET ParentName = 'BaseEvent', BaseSearch = '| search (index=* OR index=_*) | fields _time, RootObject', AccelerationSearch = ' search (index=* OR index=_*) ' WHERE DataModelId = 'SampleModel' AND ObjectName = 'SampleSet'

Delete

Datasets can be deleted by providing the DataModelId and the ObjectName of the dataset.

DELETE FROM Datasets WHERE DataModelId = 'SampleModel' AND ObjectName = 'SampleSet'

Columns