Knowledge Management

How to use specific dataset in case of multiple dataset in datamodel ?



In our datamodel, we have multiple datasets (root events/ root search).
But only the 1st one is working in the tstat search.

In below example I have 3 datasets, only SERVICE dataset is working, if I remove SERVICE then BA_LIVEBOOK will work and if remove BA_LIVEBOOK as well then RISKENGINE will work.

Data Model Structure

alt text

Below search query is to access BA_LIVEBOOK dataset but it will work only if I remove SERVICE EVENT.
Is there a different way of access in case of multiple datasets?

| tstats values(BA_LIVEBOOK.NPID) as NPID FROM datamodel=SERVICE_V7 WHERE (nodename=BA_LIVEBOOK) GROUPBY source
0 Karma

Super Champion

Hi @agoyal,

What are the populating searches for your root events/searches ?

If they are independent I would advise you to go ahead and build a separate DM for each of the root searches, a general rule of thumb would be to have a root search and then child searches to get the best performance and avoid the kind of issues you're having.


0 Karma


data in different dataset are related but queries are different. I can't use as parent/child because I am using "|" in constraint which is not allowed in child. we have 4 datasets now and may get increase later. Managing would be eaiser to have single datamodel.

Anyway, My consern is If there is option of having mutliple datasets then I don't understand why we can't use like this. May be I am missing some property which require to call the dataset in search query.

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...