DataModels

Create, query, update, and delete data models in Splunk.

Select

connector は、Splunk API を使用してId カラムを参照する検索条件を処理します。このカラムは= 演算子のサーバー側の処理をサポートします。connector はクライアント側でconnector 内で他のフィルタを処理します。

例えば、次のクエリはSplunk API によってサーバー側で処理されます。

SELECT * FROM DataModels WHERE Id = 'SampleModel'

Insert

Id カラムは挿入の最小要件です。挿入では、DataModels テーブルではId とAcceleration カラムのみが許容されます。

INSERT INTO DataModels (Id, Acceleration) VALUES ('initialname', '{"enabled":false,"earliest_time":"","hunk.file_format":"","hunk.dfs_block_size":0,"hunk.compression_codec":""}' )

Update

DataModels テーブルでは、Id が指定されている場合にAcceleration カラムの更新が可能です。Provisional 疑似カラムを設定することもできます。

UPDATE DataModels SET Provisional = 'true', Acceleration = '{"enabled":false,"earliest_time": "-1mon", "cron_schedule": "0 */12 * * *","hunk.file_format":"","hunk.dfs_block_size":0,"hunk.compression_codec":""}' WHERE Id = 'initialname'

Delete

DataModels テーブルでは、Id が指定されている場合にレコードの削除が可能です。

DELETE FROM Datamodels WHERE Id = 'initialname'

Columns


Name	Type	ReadOnly	References	Description
Id [KEY]	String	True		Link of the data model.
Disabled	Boolean	True		Indicates if the data model is disabled/enabled.
UpdatedAt	Datetime	True		Datetime of the last update of the data model.
Description	String	True		Description of the data model.
Name	String	False		The name of the data model in Splunk.
DisplayName	String	True		The name displayed for the data model in Splunk.
Author	String	True		Splunk user who created the data model.
App	String	True		Splunk app where the data model is shared.
Owner	String	True		Splunk user who owns the data model.
CanShareApp	Boolean	True		Boolean indicating whether the data model can be shared in an app.
CanShareGlobal	Boolean	True		Boolean indicating whether the data model can be shared globally.
CanShareUser	Boolean	True		Boolean indicating whether the data model can be shared by the user.
CanWrite	Boolean	True		Boolean indicating whether the data model can be extended by the user.
Modifiable	Boolean	True		Boolean indicating whether the data model can be modified.
Removable	Boolean	True		Boolean indicating whether the data model can be removed.
Acceleration	String	False		Acceleration settings for the data model. Supply JSON to specify any or all of the following settings: enabled (true or false), earliest_time (time modifier), or cron_schedule (cron string).
AccelerationAllowed	Boolean	True		Boolean indicating that acceleration is allowed or not for the data model.
AccelerationHunkCompression	String	True		Specifies the compression codec to be used for the accelerated orc or parquet format files.
DatasetCommands	String	True		Data model commands.
DatasetDescription	String	True		The JSON describing the data model.
DatasetCurrentCommand	Integer	True		Current command of the data model.
DatasetEarliestTime	Datetime	True		Earliest time of data model events being processed.
DatasetLatestTime	Datetime	True		Latest time of data model events being processed.
DatasetDiversity	String	True		Diversity of events being processed.
DatasetLimiting	Integer	True		Limitations of events being processed.
DatasetMode	String	True		Search mode events being processed.
DatasetSampleRatio	String	True		Sample ratio of the data model.
DatasetFields	String	True		Indexed fields the data model has.
DatasetType	String	True		Dataset type.
Type	String	True		Data model type.
Digest	String	True		Content digest type.
TagsWhitelist	String	True		Whitelist of data model tags.
ReadPermitions	String	True		Permissions to read this data model.
WritePermitions	String	True		Permissions to write to this data model.
Sharing	String	True		Data model sharing type.
Username	String	True		Username of the Splunk user.

Pseudo-Columns

SELECT ステートメントのWHERE 句では、疑似カラムフィールドを使用して、データソースから返されるタプルを詳細に制御することができます。


Name	Type	Description
Provisional	Boolean	Indicates whether the data model is provisional. Provisional data models are not saved. Specify true to validate a data model before saving it.