- Implementing Splunk 7（Third Edition）
- James D. Miller
- 224字
- 2021-08-27 19:42:40
Data model objects
As I mentioned, data models are constructed from a series of objects and these objects will be one of four types—event, search, transaction, or child. They are arranged hierarchically, with child objects inheriting from the parent objects they are associated with:
- Event objects are the most common data model objects, broadly representing a type of event. Event objects are typically defined by a constraint (which we will discuss next).
- Transaction objects enable you to create data models that represent transactions (groups of related events that span time) using fields that have already been added to the model via an event or search object. This means that you can't create data models that are composed only of transaction objects and their child objects. Before you create a transaction object, you must already have some event or search object trees in your model.
- Search objects use an arbitrary Splunk search that includes transforming commands to define the dataset that they represent.
- The most top-level objects in a data model are referred to as root objects and each can be a parent object to many child objects. Splunk calls the relationship of a parent and child object an object tree. The data that this object tree represents is first selected by the root and then refined by each of its child objects.