Accelerating data models
We have seen how data models can be created to collect datasets. These data models can be used to increase search speed when accelerated. Searching an accelerated data model returns search results faster than searching raw data in an index. Let’s look at how data models are stored on disk, which makes them more easily searchable compared to regular indexes. The Splunk Enterprise Knowledge Manager Manual defines a data model as a search-time mapping of datasets in a hierarchical form (https://tinyurl.com/4wyyx3ft). Data models drive tools such as Pivot and are the backbone of apps such as Splunk Enterprise Security (https://splunkbase.splunk.com/app/263). The Searches child event dataset that we saw in the previous section under Understanding Data Models | Data Model Datasets inherited constraints from the Audit root event. In addition, this dataset had its own constraints:
action=search NOT dmauditsearch