Implementing Splunk - Second Edition

Creating a data model

So now that we have a general idea of what a Splunk data model is, let's go ahead and create one. Before we can get started, we need to verify that our user ID is set up with the proper access required to create a data model. By default, only users with the admin or a power role can create data models. For other users, the ability to create a data model depends on whether their roles have write access to an app.

To begin (once you have verified that you do have the access to create a data model), you can click on Settings and then Data models (under KNOWLEDGE):

This takes you to the Data Models (management) page (shown in the ...