topic datamodel command for multilevel data model child datasets in Knowledge Management

datamodel command for multilevel data model child datasets

rajim — Thu, 15 Mar 2018 05:47:29 GMT

I want to run datamodel command to fetch the results from a child dataset which is part of a datamodel as shown in the attached screenshot. I am using the below query. But unfortunately it's not returning error. Can anybody please help me write the correct query for multilevel child dataset.

| datamodel Windows_Security_Event_Management Windows_Security_Events Account_Management_Events search

Error message:
Error in 'datamodel' command: Invalid argument: 'search'

Re: datamodel command for multilevel data model child datasets

p_gurav — Sun, 18 Mar 2018 05:12:43 GMT

Hi,

Can you try :

 | datamodel Windows_Security_Event_Management Account_Management_Events search

Re: datamodel command for multilevel data model child datasets

rajim — Tue, 29 Sep 2020 18:31:37 GMT

Yes it's working. Thank you.

So we don't need to refer the parent datamodel. right?
Also if I have another child data model of Account_Management_Events, then also is it fine to refer that data model after the data model id?

Re: datamodel command for multilevel data model child datasets

p_gurav — Sun, 18 Mar 2018 05:43:26 GMT

Yes you can directly search after datamodel name, because according to documents datamodel command only take 1 dataset name. Refer this doc:
http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Datamodel

Re: datamodel command for multilevel data model child datasets

rajim — Sun, 18 Mar 2018 05:49:04 GMT

Thank you...
I had seen that document. there is "[ ]" enclosing the data set in that document. So I thought there might be multiple datasets. Anyway, thank you for your answer.