Reporting

Datamodel and Pivot export with App

rjain15
Explorer

Hi

If I create a datamodel and pivot, can I export it and bundle it with an app?

What are the files created and how can I bundle it with the app?

thanks,
Rajesh

0 Karma

mattness
Splunk Employee
Splunk Employee

Data models are stored on disk as JSON files, and they have associated configs in datamodels.conf and metadata in local.meta (for models that you create) and default.meta (for models delivered with the product).

Models that you create are stored in <yourapp>/local/data/models while models delivered with the product can be found in <myapp>/default/data/models.

Currently there's no easy way to export data models from one app to another; you'll have to do it by hand, which means at least copying over the JSON file and the related stanza in datamodels.conf. You should also move over the related local.meta material for the datamodel as well.

If you no longer want to see the data model in the originating app you should delete the data model from that app via the UI (or, by hand, delete the JSON file and remove the related stanza in datamodels.conf).

For more information see http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managedatamodels#Manual_data_model_mana...

As for pivots, to export them save them as a report; this will create a stanza in savedsearches.conf which you can copy over to the savedsearches.conf for your new app. You'll want to do this after you move the data model over, of course.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...