https://community.splunk.com/t5/Reporting/Doing-union-of-data-model-child-objects/m-p/140826#M3143 <P>Try this instead <A href="http://answers.splunk.com/answers/215346/best-practices-to-join-two-child-objects-of-a-data.html">http://answers.splunk.com/answers/215346/best-practices-to-join-two-child-objects-of-a-data.html</A> , it will be much faster </P> Fri, 24 Apr 2015 05:55:23 GMT MuS 2015-04-24T05:55:23Z https://community.splunk.com/t5/Reporting/Doing-union-of-data-model-child-objects/m-p/140824#M3141 <P>Data Model Name Child Objects Property Values<BR /> datamodel1<BR /><BR /> childobject1 Description<BR /><BR /> record1<BR /> record2</P> <PRE><CODE> childobject2 Description record3 record4 </CODE></PRE> <P>Final output required as through search query not in data model record1<BR /><BR /> record2<BR /><BR /> record3<BR /><BR /> record4 </P> Fri, 10 Apr 2015 14:57:06 GMT https://community.splunk.com/t5/Reporting/Doing-union-of-data-model-child-objects/m-p/140824#M3141 kamalm1 2015-04-10T14:57:06Z https://community.splunk.com/t5/Reporting/Doing-union-of-data-model-child-objects/m-p/140825#M3142 <P>| set union [| datamodel <OBJECT> search | fields + "field1" "field2"] [| datamodel <OBJECT> search | fields + "field1" "field2"]</OBJECT></OBJECT></P> <P>Above solution is verified and working.<BR /> </P> Fri, 24 Apr 2015 04:38:26 GMT https://community.splunk.com/t5/Reporting/Doing-union-of-data-model-child-objects/m-p/140825#M3142 kamalm1 2015-04-24T04:38:26Z https://community.splunk.com/t5/Reporting/Doing-union-of-data-model-child-objects/m-p/140826#M3143 <P>Try this instead <A href="http://answers.splunk.com/answers/215346/best-practices-to-join-two-child-objects-of-a-data.html">http://answers.splunk.com/answers/215346/best-practices-to-join-two-child-objects-of-a-data.html</A> , it will be much faster </P> Fri, 24 Apr 2015 05:55:23 GMT https://community.splunk.com/t5/Reporting/Doing-union-of-data-model-child-objects/m-p/140826#M3143 MuS 2015-04-24T05:55:23Z