Splunk data models are really a group or set of specific information (referred to as objects) pulled together to create specific Splunk search strings, each used to generate a search that returns a particular dataset. That dataset, returned by the object you select, is governed by particular object constraints and attributes.
As I mentioned, data models are constructed from a series of objects and these objects will be one of four types—event, search, transaction, or child. They are arranged hierarchically, with child objects inheriting from the parent objects they are associated with:
- Event objects are the most common data model objects, broadly representing a type of event. Event objects are typically defined by a constraint (which we will discuss next).
- Transaction objects enable you to create data models that represent transactions (groups of related events that span time) using fields that have already been added to the model via an event...
