I 'm defining some data model and I need to use external lookup on relational db to extend event's data. In classic search I use dbxlookup command of db connect 3.1 but when I use this command on base search of data set in data model I get this error in splunkd:
Root event datasets are the most commonly-used type of root data model dataset. Each root event dataset broadly represents a type of event. For example, an HTTP Access root event dataset could correspond to access log events, while an Error event corresponds to events with error messages.
Root event datasets are typically defined by a simple constraint. This constraint is what an experienced Splunk user might think of as the first portion of a search, before the pipe character, commands, and arguments are applied. For example, status > 600 and sourcetype=access_* OR sourcetype=iis* are possible event dataset definitions.
Your only option here would be if you could make that dbxlookup automatic so that it doesn't have to be placed in the search string. I'm not that familiar with dbconnect, so I don't have an answer regarding the feasibility of doing so.