Splunk data models are really a group or set of specific information (referred to as objects) pulled together to create specific Splunk search strings, each used to generate a search that returns a particular dataset. That dataset, returned by the object you select, is governed by particular object constraints and attributes.
What does a data model search?
Data model objects
As I mentioned, data models are constructed from a series of objects and these objects will be one of four types—event, search, transaction, or child. They are arranged hierarchically, with child objects inheriting from the parent objects they are associated with:
- Event objects are the most common data model objects, broadly representing a type of event...
