Data model objects

As I mentioned, data models are constructed from a series of objects and these objects will be one of four types—event, search, transaction, or child. They are arranged hierarchically, with child objects inheriting from the parent objects they are associated with:

  • Event objects are the most common data model objects, broadly representing a type of event. Event objects are typically defined by a constraint (which we will discuss next).
  • Transaction objects enable you to create data models that represent transactions (groups of related events that span time) using fields that have already been added to the model via an event or search object. This means that you can't create data models that are composed only of transaction ...

Get Implementing Splunk 7 - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.