Knowledge Management

Splunk inherit calculated datamodel field don't show in search but show in pivot.

Path Finder

Hi Splunkers,

I try to get some fields on datamodel. And my search is ; 

 

 

| tstats `summariesonly` count from datamodel=Change where nodename=All_Changes.Account_Management.Accounts_Created  by All_Changes.src_user

 

 

 

And src_user field inherit from Account_Management root node.

This search return a results but not showing in web page.

burakatabay_0-1597819468887.png

But I do same thinks on data model pivoting, result is showing.

burakatabay_1-1597820121526.png

 

How ı fix the problem ? 

 

Thank you.

 

 

 

 

 

Labels (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Use below query, src_user field has been extracted under Account_Management

| tstats `summariesonly` count from datamodel=Change where nodename=All_Changes.Account_Management.Accounts_Created  by All_Changes.Account_Management.src_user

View solution in original post

SplunkTrust
SplunkTrust

Use below query, src_user field has been extracted under Account_Management

| tstats `summariesonly` count from datamodel=Change where nodename=All_Changes.Account_Management.Accounts_Created  by All_Changes.Account_Management.src_user

View solution in original post