Splunk data models are really a group or set of specific information (referred to as objects) pulled together to create specific Splunk search strings, each used to generate a search that returns a particular dataset. That dataset, returned by the object you select, is governed by particular object constraints and attributes.
As I mentioned, data models are constructed of a series of objects and these objects will be one of four types – Event, Search, Transaction, or Child. They are arranged hierarchically with child objects inheriting from the parent objects that they are associated with.
Event objects are the most common data model object, broadly representing a type of event. Event objects are typically defined by a constraint (which we will discuss next).
Transaction objects enable you to create data models that represent transactions (groups of related events that span time) using fields that have already been added to the model via an event...