topic Re: Problem adding Child Object to Object Model in Reporting

Problem adding Child Object to Object Model

Evanitis — Sat, 26 Apr 2014 23:32:52 GMT

I am new to Splunk Object Modela and have started trying to crate my first object model. I have completed the tutorial but have run into issues creating my first real world model.

I have created a Root Event with a constraint of sourcetype="Job Summary Report" and added a number of fields from this sourcetype to the object.

Subsequently if I try and add a child object I get the message "An object cannot have attributes with duplicate display names" This happens when trying to add a second child object.

How do I determine what attribute is causing the conflict ? I cannot see any obvious duplicates and all the attributes at this point are inherited from the the root object.

Are there any restrictions on the attribute names in the object model I should be aware of ?

Re: Problem adding Child Object to Object Model

aneels_splunk — Mon, 28 Apr 2014 17:08:36 GMT

The child should automatically inherit attributes from its parent, but it sounds like you've tried to add them again. Try deleting the attributes you've re-defined.

Re: Problem adding Child Object to Object Model

Evanitis — Tue, 29 Apr 2014 00:29:31 GMT

As I said, all the objects were inherited from the root object, so I had not added any attributes. But thanks for responding!

Re: Problem adding Child Object to Object Model

Evanitis — Mon, 28 Sep 2020 16:29:16 GMT

As it turns out, the issue (which is documented, but not anywhere obvious) is that the Field Names in my source type had spaces in them. This just fouls up the data model functions.

I ended up redefining my source to assign specific field names to it. The sourcetype was a custom type based on CSV which as far as I can tell should have removed spaces from the fields names but didn't. I doctored props.conf and used FIELD_NAMES to specify better field names for the columns and FIELD_HEADER_REGEX to ignore the old header record.

I should have been able to specify CLEAN_KEYS somehow but the exact usage escaped me (this time).