Creating Data Models

Question 1

What are data models

Answer 1

Data models are knowledge objects that apply structure to raw data making it easier to use.

Question 2

What types of datasets can data models contain?

Answer 2

• Events
• Searches
• Transactions

Question 3

What is an event dataset?

Answer 3

A dataset that contains a search.

Question 4

What is a search dataset?

Answer 4

A dataset that contains a pipe to a transforming command.

Question 5

What is a transaction dataset?

Answer 5

A dataset that contains a transaction command.

Question 6

What does each dataset contain?

Answer 6

• Constraints (the search broken down into a hierarchy)
• Fields (associated with the events that are returned by that search)

Question 7

What do child datasets inherit from their parent?

Answer 7

Constraints and Fields.

Question 8

What is the relationship between data models and pivots?

Answer 8

Data models provide the data structure that drives pivots.

Question 9

What are some restrictions when creating an accelerated persistent data model?

Answer 9

• An admin user or the “accelerate_datamodel” privilege is required.
• Private data models cannot be accelerated.
• Accelerated data models cannot be edited.
• Persistent acceleration requires searches that only use streaming commands.

Question 10

What is the syntax for searching a data model?

Answer 10

|datamodel [<data>] [<dataset>] [<data>] [strict_fields=<bool>] [allow_old_summaries=<bool>] [summariesonly=<bool>]</bool></bool></bool></data></dataset></data>

Question 11

What are the required arguments for searching a data model?

Answer 11

There are no required arguments for searching a data model.

Question 12

What are the data model search mode options?

Answer 12

• search (returns the search results exactly how they are defined)
• flat (returns the same results as search except that it strips the hierarchical information from the field names).
• accleration_search (Runs the search that the search head uses to accelerate the data model. Only works on root event datasets and root search datasets that only use streaming commands).