Regarding an unexpected behavior in Splunk Datamodel

[dhvanilshah]

Hi everyone, I am currently working with creating data models for Splunk App. For this app, I am planning to design one main Dataset, with multiple child datasets. These child Datasets, are at the equal level, and might have the fields with same name. 

Please note that all the fields are evaluated at the Child dataset level and not at the Root dataset. Also, the type of events in different child datasets might be different, that is, in one child it might be syslog, in another child, it might be JSON, etc.

It looks something like this:

• Datamodel: Datamodel_Test
  • Root Dataset: Root (index IN (main))
    • Child Dataset: Child1 (sourcetype="child1")
      • Category
      • Severity
      • Name1
    • Child Dataset: Child2 (sourcetype="child2")
      • Severity
      • Name
  • Root Dataset: Root2 (index IN main)

Main questions:

1. Severity is not available in Child2 (| tstats summariesonly=false values(Root.Child2.Severity) from datamodel=Datamodel_Test where nodename=Root.Child2)
2. Name is available in Child2 as it's renamed to Name1 in Child1 (| tstats summariesonly=false values(Root.Child2.Name) from datamodel=Datamodel_Test where nodename=Root.Child2)
3. Also, Root2 is not available as a root datamodel by the query and it's not showing any events. (| tstats summariesonly=false count as Count from datamodel=Datamodel_Test by nodename)

We tried different things to get through, though we are stuck at this issue. 

Is this an expected behavior or a bug in Splunk?

[gcusello]

Hi @dhvanilshah ,

what about running the contrain searches for each child, have you all the fields you need?

if not, you have to redesign your DataModel,

if yes, you should try to add the missing fields to the fields of each child.

Ciao.

Giuseppe

[dhvanilshah]

Hi @gcusello, 

When I run the child constraint searches in preview mode, I am able to see the fields extracted. It seems that Splunk is not supporting different evals across the child dataset for same fieldname. 

So, in my case, Root1 doesn't have any fields extracted. 

Child1 and Child2 have fields extracted in different way, and they have the same name, ie, Severity, Name, etc. 

Is this what you're asking? If not, could you please help me understand? 

[gcusello]

Hi @dhvanilshah ,

Use calculated fields with all the conditions to manage the different extraction ways, 

Ciao.

Giuseppe