ODBC Driver for Splunk

Build 23.0.8791

DataModels

Create, query, update, and delete data models in Splunk.

Select

本製品 は、Splunk API を使用してId カラムを参照する検索条件を処理します。このカラムは= 演算子のサーバー側の処理をサポートします。本製品 はクライアント側で本製品 内で他のフィルタを処理します。

例えば、次のクエリはSplunk API によってサーバー側で処理されます。

SELECT * FROM DataModels WHERE Id = 'SampleModel' 

Insert

Id カラムは挿入の最小要件です。挿入では、DataModels テーブルではId とAcceleration カラムのみが許容されます。

INSERT INTO DataModels (Id, Acceleration) VALUES ('initialname', '{"enabled":false,"earliest_time":"","hunk.file_format":"","hunk.dfs_block_size":0,"hunk.compression_codec":""}' )

Update

DataModels テーブルでは、Id が指定されている場合にAcceleration カラムの更新が可能です。Provisional 疑似カラムを設定することもできます。

UPDATE DataModels SET Provisional = 'true', Acceleration = '{"enabled":false,"earliest_time": "-1mon", "cron_schedule": "0 */12 * * *","hunk.file_format":"","hunk.dfs_block_size":0,"hunk.compression_codec":""}' WHERE Id = 'initialname' 

Delete

DataModels テーブルでは、Id が指定されている場合にレコードの削除が可能です。

DELETE FROM Datamodels WHERE Id = 'initialname' 

Columns

Name Type ReadOnly References Description
Id [KEY] String True

Link of the data model.

Disabled Boolean True

Indicates if the data model is disabled/enabled.

UpdatedAt Datetime True

Datetime of the last update of the data model.

Description String True

Description of the data model.

Name String False

The name of the data model in Splunk.

DisplayName String True

The name displayed for the data model in Splunk.

Author String True

Splunk user who created the data model.

App String True

Splunk app where the data model is shared.

Owner String True

Splunk user who owns the data model.

CanShareApp Boolean True

Boolean indicating whether the data model can be shared in an app.

CanShareGlobal Boolean True

Boolean indicating whether the data model can be shared globally.

CanShareUser Boolean True

Boolean indicating whether the data model can be shared by the user.

CanWrite Boolean True

Boolean indicating whether the data model can be extended by the user.

Modifiable Boolean True

Boolean indicating whether the data model can be modified.

Removable Boolean True

Boolean indicating whether the data model can be removed.

Acceleration String False

Acceleration settings for the data model. Supply JSON to specify any or all of the following settings: enabled (true or false), earliest_time (time modifier), or cron_schedule (cron string).

AccelerationAllowed Boolean True

Boolean indicating that acceleration is allowed or not for the data model.

AccelerationHunkCompression String True

Specifies the compression codec to be used for the accelerated orc or parquet format files.

DatasetCommands String True

Data model commands.

DatasetDescription String True

The JSON describing the data model.

DatasetCurrentCommand Integer True

Current command of the data model.

DatasetEarliestTime Datetime True

Earliest time of data model events being processed.

DatasetLatestTime Datetime True

Latest time of data model events being processed.

DatasetDiversity String True

Diversity of events being processed.

DatasetLimiting Integer True

Limitations of events being processed.

DatasetMode String True

Search mode events being processed.

DatasetSampleRatio String True

Sample ratio of the data model.

DatasetFields String True

Indexed fields the data model has.

DatasetType String True

Dataset type.

Type String True

Data model type.

Digest String True

Content digest type.

TagsWhitelist String True

Whitelist of data model tags.

ReadPermitions String True

Permissions to read this data model.

WritePermitions String True

Permissions to write to this data model.

Sharing String True

Data model sharing type.

Username String True

Username of the Splunk user.

Pseudo-Columns

SELECT ステートメントのWHERE 句では、疑似カラムフィールドを使用して、データソースから返されるタプルを詳細に制御することができます。

Name Type Description
Provisional Boolean

Indicates whether the data model is provisional. Provisional data models are not saved. Specify true to validate a data model before saving it.

Copyright (c) 2024 CData Software, Inc. - All rights reserved.
Build 23.0.8791