The search string below returns events from the data model named Application_State.
| datamodel Application_State All_Application_State search
The search string does the following:
* It uses the datamodel command to access a data model in Splunk. The datamodel command takes two arguments: the name of the data model and the name of the dataset within the data model.
* It specifies the name of the data model as Application_State. This is a predefined data model in Splunk that contains information about web applications.
* It specifies the name of the dataset as All_Application_State. This is a root dataset in the data model that contains all events from all child datasets.
* It uses the search command to filter and transform the events from the dataset. The search command can use any search criteria or command to modify the results.
Therefore, the search string returns events from the data model named Application_State.