It seems to me that the data model builder relies on events and since i don't receive events but rather a table of values i seem to fail in using the information gathered by a sql query as a root search for a data model.
Is there a way to consume data from a sql database and infuse it into a data model in Splunk 6? (like, mangling the db query results into events - after all they do have some datestamp i can reformat into a splunk conform timestamp)
As i see it one can create some collect search populating a special index and those items are events (if you can use some field as _time, else the indexing time is _time) and so you get events and can build a data model on top.
hope this helps someone 🙂
As i see it one can create some collect search populating a special index and those items are events (if you can use some field as _time, else the indexing time is _time) and so you get events and can build a data model on top.
hope this helps someone 🙂