Siren Investigate can attempt to automatically identify the relational configuration between any set of Index Pattern Searches.
Go to the Management > Data Model and click Relations Wizard.
Then select an index pattern search to analyze for relations.
After you confirm your selection, Siren Investigate calculates relations for the chosen searches.
At the end of the process, all relations found are presented in a report. Relations found are grouped by target entity (either a field or an Entity Identifier). Selecting a target displays all the fields that cab be connected in a relation to the selected target.
To provide a clear idea of the data that can be connected in the relations, selecting a source field displays a list of terms in the field; an additional eye icon is also provided for full document inspection of some sample documents.
You can edit the names of Entity Identifiers. Note that assigning the same Entity Identifier name to two different targets will merge the targets into a single output identifier.
Fields in the report can be included or excluded from the output result by selecting or clearing the appropriate check box.
The Already Existing Relations tab in the report can be used to track the list of existing relations in the data set and their status with respect to the reported relations. Relations displayed as Found (in green) are not duplicated as output relations, because they are already present in the existing relational configuration of the data set. Relations displayed as Not Found (in yellow) were not found by the relations wizard and therefore could not be automatically confirmed.
Click Ok to close the report and put all selected relations in a temporary state. They are shown in green in the data model page but will otherwise be ignored in other parts of Siren Investigate.
The temporary state is useful to provide a final overview of the newly generated relations and enable further customization, as if they were manually inserted (for example, changing the link names).
Caution: Temporary relations are associated with the current browser session. If the browser closes, all temporary relations are lost.
When you are sure you want to commit the temporary auto-relations, click Save All (at the top of the relations page). Alternatively, you can click Remove All to discard all the auto-relations.
It is also possible to save or remove individual temporary entity identifiers and relations by treating them as manually defined relations.