Splunk inherit calculated datamodel field don't show in search but show in pivot.

[burakatabay]

Hi Splunkers,

I try to get some fields on datamodel. And my search is ; 

| tstats `summariesonly` count from datamodel=Change where nodename=All_Changes.Account_Management.Accounts_Created  by All_Changes.src_user

And src_user field inherit from Account_Management root node.

This search return a results but not showing in web page.

But I do same thinks on data model pivoting, result is showing.

How ı fix the problem ? 

Thank you.

[harsmarvania57 · Accepted solution]

Use below query, src_user field has been extracted under Account_Management

| tstats `summariesonly` count from datamodel=Change where nodename=All_Changes.Account_Management.Accounts_Created  by All_Changes.Account_Management.src_user