topic Re: How do you reference a "root search" from a Data Model? in Reporting

How do you reference a "root search" from a Data Model?

rjthibod — Mon, 28 Sep 2020 19:08:12 GMT

I have been using Objects and Pivot with much success. In the process of trying to play with the "Root Search" concept, I cannot find documentation on how to actually use the root search. Specifically, how does one include a root search in a Simple XML dashboard? For this example, assume my data model's object ID is "my_dm" and the root search's object id "summary_ids".

Do I reference "summary_ids" in the search field? Do I specify "id='summary_ids'" in a "search" XML field?

Please point me to any documentation or examples that you know of.

Re: How do you reference a "root search" from a Data Model?

MuS — Tue, 10 Mar 2015 12:36:29 GMT

Hi rjthibod,

You can use the pivot command instead http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Pivot
Just tested it and created a root search called foo in my datamodel called Tutorial which is basically just a * search and I get back some events from the Splunk Unix App and therefore a field called COMMAND. So I can use this to test the pivot command like this:

| pivot Tutorial foo values(COMMAND) AS COMMAND

works like a charm.....

cheers, MuS

Re: How do you reference a "root search" from a Data Model?

rjthibod — Tue, 10 Mar 2015 13:45:46 GMT

Thank you! That page is exactly what I was looking for.

Re: How do you reference a "root search" from a Data Model?

MuS — Tue, 10 Mar 2015 13:48:32 GMT

okay, I'll update my answer so you can accept the correct answer 😉