TDV Adapter for Splunk

Build 24.0.9060

UploadedModel

An example of a table object inside a data model.

Select

This is an example of a view generated from a table object inside a data model. The adapter will use the Splunk APIs to process the following query components; the adapter processes other parts of the query client-side in memory.

All columns support server-side processing for the following operators and functions.

  • Operators: =, <, >, >=, <=, IN, IS NULL, IS NOT NULL, NOT
  • Functions: AVG, SUM, MIN, MAX, COUNT, STDEV, STDEVP, VAR, VARP

LIMIT, ORDER BY, GROUP BY, and HAVING are also processed server-side. An exception is the case when in the selected columns, there are fields that are not in the GROUP BY, and GROUP BY, criteria, and limiting are handled client-side.

In the case when an unsupported criteria or function is used, all processing will be completed client-side (except selecting specified fields). This is also the case when a SELECT statement has a column that is not in the GROUP BY clause.

For example, the following queries are processed server side:

SELECT Component, Timeendpos as Timeend FROM [UploadedModel] WHERE Component = 'Saved' OR DEST_CITY_MARKET_ID != '' AND DEST_AIRPORT_ID NOT IN ('1', '2') ORDER BY ORIGIN_AIRPORT_ID DESC LIMIT 5 

SELECT AVG(DEST_AIRPORT_ID), ORIGIN_AIRPORT_ID FROM [UploadedModel] GROUP BY ORIGIN_AIRPORT_ID HAVING AVG(DEST_AIRPORT_ID) > 0 

Columns

Name Type Description
_time Datetime
DEST_AIRPORT_ID Int
DEST_AIRPORT_SEQ_ID Int
DEST_CITY_MARKET_ID Int
host String
linecount Int
ORIGIN_AIRPORT_ID Int
ORIGIN_AIRPORT_SEQ_ID Int
ORIGIN_CITY_MARKET_ID Int
punct String
source String
sourcetype String
splunk_server String
timestamp String

Copyright (c) 2024 CData Software, Inc. - All rights reserved.
Build 24.0.9060