Creating a Data Model in Raw Mode

You can add a new data model that can be activated to analyze results in the normalized format. All enabled models can be searched using the source filter from the Search tab.

Before you beginThis option is for advanced users who understand JSON syntax to create a new parsing rule. If otherwise, use the graphical mode to create new data model. For details, see Creating a Data Model in Graphical Mode.
    Procedure
  1. Go to Management > Advanced Features > Data Models.
  2. On the Data Models page, click Create a New Data Model.
  3. Click Switch to raw mode to add a new model in raw mode.
  4. In the Sample events panel, paste the sample events to analyze data in normalized format. This data can be helpful in defining the parsing rule based on the log source. Once you add the data model, the sample data is always available when editing the same data model or associated parsing rules.
    Note: You can paste maximum of 100 KB sample data.
  5. In the Raw configuration mode panel, enter the parsing rule. Ensure to define source filter, parsing rule, and parser properties in a valid JSON syntax. The content of your JSON file might vary depending on the fields selected and configured for your parsing rule.
    Note: For an example of the JSON file and syntax, you can open an existing data model and view its parsing rule in the raw mode.
  6. Click Validate to ensure that the rule syntax is valid. Click Format to format the JSON.
  7. Click to refresh the Parser preview panel to view all extracted columns and their data types that are matched by the defined parsing rule. Click in the Type field to change the supported data types and select the data type from the list.
    Note: This option is available only when the data is pasted in the Sample events panel and at least one parsing rule is enabled.
  8. Click Save to add a new data model. The Data Models page displays the newly added model.