Creating a data model for application logs

This recipe is similar to the first one, except this time you will create a data model for application logs. You will be using Splunk's Data Model Editor to do this and will define several dataset types and add dataset constraints and fields. To save pages, this recipe will be lighter on screenshots than the first recipe. The first recipe should be used as a reference where needed.

Getting ready

To step through this recipe, you will need a running Splunk Enterprise server, with the sample data loaded from Chapter 1, Play Time - Getting Data In. You should have also completed the recipes from the earlier chapters. You should have also completed the first recipe in this chapter...