When creating a data model, which root dataset requires at least one constraint?

Question

Options

• ARoot transaction dataset
• BRoot event dataset
• CRoot child dataset
• DRoot search dataset

• A
  4% (1)
• B
  89% (24)
• C
  7% (2)

Explanation

This is because root event datasets are defined by a constraint that filters out events that are not relevant to the dataset. A constraint for a root event dataset is a simple search that returns a fairly wide range of data, such as sourcetype=access_combined. Without a constraint, a root event dataset would include all the events in the index, which is not useful for data modeling. You can learn more about how to design data models and add root event datasets from the Splunk documentation. The other options are incorrect because root transaction datasets and root search datasets have different ways of defining their datasets, such as transaction definitions or complex searches, and root child datasets are not a valid type of root dataset.

No community discussion yet for this question.