Datasets
Create, query, update, and delete datasets in Splunk.
Select
The Datasets table requires DataModelId in the WHERE clause. The DataModelId column supports server-side processing for the = operator. The connector processes other search criteria client-side within the connector.
SELECT * FROM DataSets WHERE DataModelId = 'SampleModel'
Insert
Splunk allows inserts only when DataModelId, ParentName, and ObjectName are all specified.
INSERT INTO [Datasets] (ObjectName, ParentName, DataModelId) VALUES ('SampleSet', 'BaseEvent', 'SampleModel')
Update
The Datasets table allows updates when DataModelId is specified. The columns that can be updated in this case are the following: Description and DisplayName.
When ObjectName is also specified, you can update the following columns: ObjectDisplayName, ParentName, Comment, Fields, Calculations, Constraints, Lineage, ObjectSearchNoFields, ObjectSearch, AutoextractSearch, PreviewSearch, AccelerationSearch, BaseSearch, and TsidxNamespace.
UPDATE Datasets SET Description = 'model description', DisplayName = 'Model Display Name' WHERE DataModelId = 'SampleModel' UPDATE Datasets SET ParentName = 'BaseEvent', BaseSearch = '| search (index=* OR index=_*) | fields _time, RootObject', AccelerationSearch = ' search (index=* OR index=_*) ' WHERE DataModelId = 'SampleModel' AND ObjectName = 'SampleSet'
Delete
Datasets can be deleted by providing the DataModelId and the ObjectName of the dataset.
DELETE FROM Datasets WHERE DataModelId = 'SampleModel' AND ObjectName = 'SampleSet'
Columns
Name | Type | ReadOnly | References | Description |
ObjectName [KEY] | String | False |
Name of the dataset object. | |
DatamodelId [KEY] | String | False |
DataModels.Id |
Id of the data model the object belongs to. |
DisplayName | String | False |
Name of the data model the object belongs to. | |
Description | String | False |
Dataset description. | |
ObjectNameList | String | True |
List of the objects in the data model. | |
ObjectDisplayName | String | False |
Name displayed in Splunk for the object. | |
ParentName | String | False |
Name of the Parent Event. | |
Comment | String | False |
Dataset comments. | |
Fields | String | False |
Dataset events indexed fields. | |
Calculations | String | False |
Saved calculations for dataset fields. | |
Constraints | String | False |
Saved constraints for dataset fields. | |
Lineage | String | False |
Dataset lineage. | |
ObjectSearchNoFields | String | False |
Object search query without fields. | |
ObjectSearch | String | False |
Saved search query for the object. | |
AutoextractSearch | String | False |
Search query for autoextraction. | |
PreviewSearch | String | False |
Search preview query. | |
AccelerationSearch | String | False |
Search query including acceleration. | |
BaseSearch | String | False |
Basic search query. | |
TsidxNamespace | String | False |
Allocated namespace. | |
EventBased | Integer | True |
Number of Event-Based objects in the data model. | |
TransactionBased | Integer | True |
Number of Transaction-Based objects in the data model. | |
SearchBased | Integer | True |
Number of Search-Based objects in the data model. |