Splunk Knowledge Object : detail discussion on "data model"

[@gregsmith2141]

This data model and data model acceleration tutorial is awesome! I have been a System Engineer for over 30 years (different industry) and his training is consistently superior to anything I have ever had. His methodology of discussing the topic at a high level and then diving into lower level details is a marvelous teaching style. The video and audio quality are excellent and his diction is good and very understandable. His use of screen shots and live demos is well done. I have watched MANY of his training videos and am thankful for them. Very tactical.

[@splunk_ml]

Thanks for your valuable feedback Greg 🙏

[@valarmathijaganathan6694]

I have been watching your videos for the last 2 weeks and I find learning in your channel is crystal clear and I can have also gained an in-depth knowledge as well in every topic

[@dilippanwar]

Awesome video. Better than offical splunk lectures. Thanks for your valuable contribution.

[@splunk_ml]

Thank you Dilip. Please share this channel with your colleagues. I need you guys support.

[@EViL3666]

Every time I search for a video tutorial on Splunk, I always hit your videos - So thank you for taking the time to create such a comprehensive set of videos, you've certainly made my learning/research easier. Consider me subscribed!

[@splunk_ml]

You're very welcome! Kelvin.

[@nagp3600]

You are incredible.Your clarity and intention to encourage free learning is remarkable.

[@splunk_ml]

Thank you ☺️

[@dinakarn2770]

I love the way of your teaching and i got full information about data models

[@aaoouch]

I have been looking for something like this for a long time. Thanks for creating such an excellent content

[@anonymoussaif7361]

Really super and well explain each and every thing on data model

[@simple-security]

Do you talk about Data Model ingestion costs anywhere in your videos? Is there a query or dashboard that helps monitor costs associated with your data models (with and without acceleration enabled)? Thank you.

[@obinnaekeh9188]

Thanks for the video. Your channel is awesome

[@madhurimayank8982]

Thank you for this nice video. I had a question here, for example, if in my dashboard i am using an events generated from datamodel whose acceleration range is set to 30 days. What will be the impact if i select 60 days from the timerange picker from the dashboard ?

[@anoopramachandran5197]

Great video Siddhartha!!! Thank you for doing this.

[@splunk_ml]

welcome Anoop :)

[@vershsingh7120]

Hi Sid, I am not able see the Country Code filed in lookup table of Data model. As I've added it in setting>lookup>addfile. Also provide global permission.

[@nitinat3590]

Excellent discussion! Thanks for sharing.

[@korablack2511]

Thank you so much for this, you are clearly a ninja !

[@vershsingh7120]

I am not able see the Country Code filed in lookup table of Data model. As I've added it in setting>lookup>addfile. Also provide global permission. while I can search in normal search & Reporting through input look up command.

[@jayachandrandhoni4928]

Simple and more informative.. Thanks buddy

[@splunk_ml]

Thanks man 👍

[@amosadomowim6037]

Hi, quick question, when you clicked on 'pivot' on the dataset window, and then clicked on the continent, it showed "distinct Count of Continent" as 6 but mine showed "count of continent' as 9551. Any reason why I'm getting count instead of distinct count? Thanks.

[@amosadomowim6037]

Nevermind sir, figured it out.

[@valarmathijaganathan6694]

Could it be possible to create some scenario-based interview questions on Splunk?

[@guilhermecervo1560]

Hello, I'm facing a problem with role restriciton in searchs with accelerated Datamodels, maybe you could help me. I applied the restriction in the role and everything was working perfect, even with searchs in datamodel. However, when I accelerated my datamodel, the role restriction filters stopped working. I'm imaging that it was due to the tsidx files generated by acceleration. Do you have any idea how can I apply such restriction even in accelerated datamodels?

[@DirectionNext]

At the video timeline 20:22, I followed the exact procedure. However, the country is not appearing in the interesting field. How did you get this?

[@splunk_ml]

did you created the lookup correctly? Then it should create the country field as well.

[@pinkushgaba4003]

Thank you for this great lesson. I have to make a pivot showing monthly count. I am stuck at trying to extract month from a date field as a calculated field using eval command. Is it possible to do that in a data model? I have to make a pivot showing monthly count. Also, If I have a filter on the dashboard page for all the panels, how can i add that filter to function with the pivot?

[@splunk_ml]

In datamodel you can add eval field, using that you can extract month. I have discussed eval field as well in my video. Regarding your second question there is a pivot command which you can used in your dashboard.

[@suvasreechatterjee6588]

Hi sir I have created Country field and in splunk but not showing country in add data drop down under datamodel

[@haogedeng8842]

Thank you so much sir for sharing, very helpful!

[@shenazgilani6370]

very well explained ..Wondering about transaction dataset ..?

[@splunk_ml]

I am yet to create a video for that...I will be posting soon ☺️

[@Sandeep223358]

Is it similar to the Splunk Common Information Model? If yes do we need to install the ad-on to do all the stuff in the video lecture?Thanks

[@splunk_ml]

Data models are used in CIM app. You no need to install CIM for this tutorial. Data Model is feature of Splunk.

[@Sandeep223358]

@@splunk_ml Thanks for your reply. Do we use data models only in CIM app?

[@splunk_ml]

no no....data models can be used at dashboards or create pivot reports as well.

[@Sandeep223358]

Splunk & Machine Learning Thanks again for your reply. Last question, CIM is used only for normalizing data with built in data models right? Can we create our own data models in CIM? Is there any tutorial from your side on this CIM concept?

[@saikiranpinnamshetty1205]

hey Sid, quick question on DM I have cloned Authentication data model (not accelerated) , and added my few needy fields when I tried to use that in my search query I'm getting 0 results |tstats count as count values(Authentication_clone.user) as user values(Authentication_clone.Account_Name) as Account_Name where datamodel=Authentication_clone.Authentication where Authentication_clone.signature_id=4624 anything I'm missing here

[@splunk_ml]

you mean from the CIM application you cloned the DM? In that case you need to create corresponding tags and extract corresponding fields so that the DM can understand your data.Please have a look at the video I created for CIM. kzbin.info/www/bejne/fpXVcnqErrCoidU

[@manigandanumapathy4840]

Well explained. Thanks sir again!!

[@TheGopinath369]

Can you please make a video how to configure and migrate the Splunk data into smartstore

[@valarmathijaganathan6694]

When I upload the Zomato.csv file in Splunk it shows me in a corrupted format. What should I do and even the country code as well?

[@splunk_ml]

I will check the github and let you know

[@rajurana6949]

eval continent=case(Country IN ("India", "Indonesia","Phillipines", "Singapore","Qatar", "Sri Lanka","Turkey","UAE"), "Asia", Country IN ("Australia","New Zealand"), "Oceania", Country IN ("Brazil"), "South America", Country IN ("Canada","United States"), "North America", Country IN ("South Africa"), "Africa", Country IN ("United Kingdom"), "Europe")

[@yogigolla]

Excellent sir ! Thanks !

[@varun-bigdataanalytics4892]

Hello, I want to understand the integration of css and js in splunk in depth(Basically want to enhance the look of my dashboards). Could you please share the videos if you have for the same?

[@nishadt]

As always excellent video Sid, I am still confused little accelaration and how summary data is built, high time for Splunk Analytics for Hadoop video.

[@splunk_ml]

Thanks Nishad. I will see if I can set it up, will try to cover that.

[@krishnapriyadharshini4038]

Thanks for making this video..

[@__goyal__]

Thank you for the easy explanation!

[@ngotrongnghia9928]

It seems there should be some steps we missed here. Because even I can inputlookup countrycode and zomato as well from search, unfortunately Splunk doesn't show "Country Code" field in the side bar. So could you please kindly help to clarify me on this?

[@ngotrongnghia9928]

also if using countrycode in .xls format, when creating lookups, my Splunk is crashed (Splunk version 8.2.4). I have to convert it to .csv.

[@splunk_ml]

yes splunk doesnt support .xls as lookup file, its needs to be csv. Also regarding your first question are still facing the issue?

[@vasthavreddy2264]

Hi sir I need that country code Excel sheet to practice Can you please provide me that sheet

[@madhavam274]

Good video thanks

[@ronkoss814]

Great tutorial. And you can use the video as a drinking game as well: drink a shot whenever the author says "ok". ;-)

[@splunk_ml]

🤣🤣🤣 this is very old video...I get rid of that bad habit recently....but amazing idea ...I will try one day 😆

[@tatifor9624]

Studiying justo from these 14 videos is enough to get my power user certification? Can someone help me on that?

[@splunk_ml]

Hello, I would suggest you have a look at the below video where I discussed about different splunk certifications kzbin.info/www/bejne/kKirp5KmbKede7c In the video description you will find the github link for an excel file... For each certification path I have added and still adding the KZbin video link of this channel. Hopefully that will be useful. github.com/siddharthajuprod07/youtube/tree/master/splunk_certification_path

[@amarkondraju1379]

Hatsoff sir

[@narendrajha2628]

Thank you helpful

[@timlindgren478]

ok. :)