Object constraining

All data model objects are defined by sets of constraints that will filter out information that is not pertinent to the object. A constraint may be a simple Splunk search (with no pipes or additional commands), a more complex search, or even a transaction. Constraints are inherited by child objects. Constraint inheritance ensures that each child object represents a subset of the data represented by its parent objects. So, for example, a data model may have a root object that defines a particular indexed source (sourcetype=speciallogs_*), while a child object of that root might narrow down that search to only the errors that appear in that datasource (error*). You might use this data model if you know that you only want to report on errors within the events that belong to the speciallogs sourcetype.