https://community.splunk.com/t5/Splunk-Search/How-to-join-multiple-child-objects-of-a-data-model/m-p/128456#M34869 <P>Can you define all of the calculated fields at the top level data model?</P> Tue, 07 Apr 2015 10:54:29 GMT dmaislin_splunk 2015-04-07T10:54:29Z https://community.splunk.com/t5/Splunk-Search/How-to-join-multiple-child-objects-of-a-data-model/m-p/128455#M34868 <P>We have a situation where we need to join multiple child objects of a data model. </P> <P>e.g.</P> <PRE><CODE> ProjectInformation (Datamodel Object) _time host .......... ChildOne (Datamodel Child Object) _time host ............ field1 CalculatedField2 ChildTwo(Datamodel Child Object) _time host ............ field 1 CalculatedField3 ChildThree(Datamodel Child Object) _time host ............ CalculatedField3 CalculatedField4 </CODE></PRE> <P>We would like to have a result with following fields:</P> <PRE><CODE> CalculatedField2; CalculatedField3; CalculatedField4 by field1 </CODE></PRE> <P>where field1 value for ChildThree should be evaluated from ChildTwo.field 1 where ChildTwo.CalculatedField2 = ChildThree.CalculatedField2 </P> Mon, 06 Apr 2015 20:46:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-multiple-child-objects-of-a-data-model/m-p/128455#M34868 sanjay_shrestha 2015-04-06T20:46:08Z https://community.splunk.com/t5/Splunk-Search/How-to-join-multiple-child-objects-of-a-data-model/m-p/128456#M34869 <P>Can you define all of the calculated fields at the top level data model?</P> Tue, 07 Apr 2015 10:54:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-multiple-child-objects-of-a-data-model/m-p/128456#M34869 dmaislin_splunk 2015-04-07T10:54:29Z