Splunk Power User: Data Models, Pivot, and Acceleration

Data models

A data model is a structured, hierarchical description of your data: a root event (constraints such as index and sourcetype), child objects, and fields that can be extracted, eval-based, lookup-based, or regex-based. Inspect one with | datamodel Web Web search (returns the generated SPL) or | datamodel Web Web flat (returns field names). Models are edited under Settings > Data Models.

Pivot

Pivot is the point-and-click UI over a data model: add filters, split rows and columns, add column values, and Splunk builds the SPL. A Pivot does not require acceleration, but it is slow on large data unless the model is accelerated. Pivot elements can be saved as reports and edited later.

Acceleration

Data model acceleration (DMA) builds tsidx summaries in the index for a whole data model, so child objects inherit acceleration. Accelerated data is queried with tstats, which reads summaries only:

| tstats count FROM datamodel=Web.Web BY Web.host, Web.status

Use summariesonly=true to force tstats to answer solely from summaries and expose gaps. Fields created by eval or lookup inside the data model usually are not in summaries, so filtering on them can fail or return partial counts.

Worked example - compare before trusting:

| tstats count FROM datamodel=Web.Web WHERE Web.status=500 BY Web.host

vs. index=web sourcetype=access_combined status=500 | stats count BY host over the same window. A mismatch usually means the acceleration time window does not cover the range, or a non-summary field was used.

Rule of thumb: DMA is for repeated dashboards over large data; raw searches are for one-off deep dives.