Create and manage data models in Splunk Enterprise Security

Create and manage data models using the Content Management page in Splunk Enterprise Security.

  • Review the list of data models in Splunk Enterprise Security.
  • Review the next scheduled time, acceleration status, and choose whether or not to accelerate a data model.
  • Click a data model name to edit the data model.

Create a data model

  1. From the Enterprise Security menu bar, select Configure > Content > Content Management.
  2. Click Create New Content and select Data Model.
  3. Create a data model following the instructions in the Splunk platform documentation.
    • For Splunk Enterprise, see Create a data model in the Splunk Enterprise Knowledge Manager Manual.
    • For Splunk Cloud Platform, see Design data models in the Splunk Cloud Platform Knowledge Manager Manual.