Knowledge Management

Splunk inherit calculated datamodel field don't show in search but show in pivot.

burakatabay
Path Finder

Hi Splunkers,

I try to get some fields on datamodel. And my search is ; 

 

 

| tstats `summariesonly` count from datamodel=Change where nodename=All_Changes.Account_Management.Accounts_Created  by All_Changes.src_user

 

 

 

And src_user field inherit from Account_Management root node.

This search return a results but not showing in web page.

burakatabay_0-1597819468887.png

But I do same thinks on data model pivoting, result is showing.

burakatabay_1-1597820121526.png

 

How ı fix the problem ? 

 

Thank you.

 

 

 

 

 

Labels (2)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Use below query, src_user field has been extracted under Account_Management

| tstats `summariesonly` count from datamodel=Change where nodename=All_Changes.Account_Management.Accounts_Created  by All_Changes.Account_Management.src_user

View solution in original post

harsmarvania57
Ultra Champion

Use below query, src_user field has been extracted under Account_Management

| tstats `summariesonly` count from datamodel=Change where nodename=All_Changes.Account_Management.Accounts_Created  by All_Changes.Account_Management.src_user
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...