Knowledge Management

Splunk inherit calculated datamodel field don't show in search but show in pivot.

burakatabay
Path Finder

Hi Splunkers,

I try to get some fields on datamodel. And my search is ; 

 

 

| tstats `summariesonly` count from datamodel=Change where nodename=All_Changes.Account_Management.Accounts_Created  by All_Changes.src_user

 

 

 

And src_user field inherit from Account_Management root node.

This search return a results but not showing in web page.

burakatabay_0-1597819468887.png

But I do same thinks on data model pivoting, result is showing.

burakatabay_1-1597820121526.png

 

How ı fix the problem ? 

 

Thank you.

 

 

 

 

 

Labels (2)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Use below query, src_user field has been extracted under Account_Management

| tstats `summariesonly` count from datamodel=Change where nodename=All_Changes.Account_Management.Accounts_Created  by All_Changes.Account_Management.src_user

View solution in original post

harsmarvania57
Ultra Champion

Use below query, src_user field has been extracted under Account_Management

| tstats `summariesonly` count from datamodel=Change where nodename=All_Changes.Account_Management.Accounts_Created  by All_Changes.Account_Management.src_user
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...