Creating a data model for application logs

This recipe is similar to the first one, except this time you will create a data model for application logs. You will be using Splunk's Data Model Editor to do this and will define several dataset types and add dataset constraints and fields. To save pages, this recipe will be lighter on screenshots than the first recipe. The first recipe should be used as a reference where needed.

Getting ready

To step through this recipe, you will need a running Splunk Enterprise server, with the sample data loaded from Chapter 1, Play Time - Getting Data In. You should have also completed the recipes from the earlier chapters. You should have also completed the first recipe in this chapter and be familiar with navigating the Splunk user interface.

How to do it...

Follow the steps in this recipe to create the Application data model:

1. Log in to your Splunk server.
2. Select the Operational Intelligence application.
3. Select the Settings menu item at the top-right corner of...