Splunk 7.x Quick Start Guide

Using data models in search

Data models are used in Splunk searches and for Pivots, which we'll discuss shortly. You can also use your data model to perform searches by using the from command after a pipe at the beginning of the search, and indicating which data model you want to apply. You can specify by using a child dataset in the search by using the dot operator (.) and then the child dataset's name:

| from datamodel:Web_Logs.Web_Errors

You can also launch a search using a data model by finding the data model listing in the Settings | Data models page and clicking Explore | Investigate in Search. In the following screenshot, you can see this in use. Only events with a status of 400 or greater are returned, and the fields listed on the ...