Splunk Operational Intelligence Cookbook

Creating a data model for application logs

This recipe is similar to the first, except this time, you will create a data model for application logs. You will be using Splunk's Data Model Editor to do this and will define a number of object types, and add constraints and attributes. In order to save pages, this recipe will be lighter on screenshots than the first recipe. The first recipe should therefore be used as a reference where needed.

Getting ready

To step through this recipe, you will need a running Splunk Enterprise server, with the sample data loaded from Chapter 1, Play Time – Getting Data In, and the completed recipes from earlier chapters. You should have also completed the first recipe in this chapter and be familiar with navigating ...