Review the crawler-discovered schema for a DDSS dataset

Ready a DDSS federated dataset for federated search by reviewing, editing, and confirming its crawler-discovered schema.

When you are wrapping up DDSS federated dataset definition and you select Create dataset on the Review step, a crawler process launches that scans the dataset to discover its schema.

The crawler process might take a few minutes to complete. If it completes without errors, your DDSS dataset will have a Status of Needs action.

What does Needs action mean? It means you need to review the schema that the crawler process discovered, edit it as necessary, and confirm that you have inspected it, so you can use the new DDSS dataset in federated searches.

Note: If your DDSS dataset has a Status of Ready and you just want to edit it, see Manage a DDSS dataset.
  • A role on your Splunk Cloud Platform deployment with the edit_connections and edit_datasets capabilities. See Define roles on the Splunk platform with capabilities in the Splunk Cloud Platform Manage Users and Security manual.

  • You must have completed the definition of your DDSS federated dataset and selected Create dataset on the Review page.

  • On the Datasets list page, your DDSS federated dataset must have a Status of Needs action.

  1. In Catalog, on the Datasets tab, select a DDSS federated dataset with a Status of Needs action.
  2. In the right-hand sidebar, select the Actions icon (An icon resembling 3 dots stacked in a vertical line.) and Manage.
  3. Go to the Schema section to review the schema fields that the crawler process discovered for your dataset and update the schema if necessary.
    Note: The following schema update options assume that you are using the Field list view for the schema. You can also edit, delete and add schema fields through the JSON view. Your input must match the JSON data schema (dataSchema). See JSON standards for the data and partition schemas.
    1. (Optional) Edit schema errors. You can change the Name and Data type of any given schema field, and you change the schema order so that it fits the actual schema in your dataset.
    2. (Optional) Delete fields that do not belong in the schema.
    3. (Optional) Replace fields that are missing from the schema by selecting Add field.
    4. Select I confirm that I have reviewed the schema.
  4. Select Save to save your changes.
Your DDSS federated dataset is ready to be used in federated searches.
Now that this federated dataset is ready to be shared and searched, do these things:

You can also go to the Manage tab for the DDSS federated dataset at any time to update other settings for the dataset. See Manage a DDSS dataset.