Knowledge Management

datamodel command for multilevel data model child datasets

rajim
Path Finder

I want to run datamodel command to fetch the results from a child dataset which is part of a datamodel as shown in the attached screenshot. I am using the below query. But unfortunately it's not returning error. Can anybody please help me write the correct query for multilevel child dataset.

| datamodel Windows_Security_Event_Management Windows_Security_Events Account_Management_Events search

Error message:
Error in 'datamodel' command: Invalid argument: 'search'

alt text

0 Karma
1 Solution

p_gurav
Champion

Hi,

Can you try :

 | datamodel Windows_Security_Event_Management Account_Management_Events search

View solution in original post

p_gurav
Champion

Hi,

Can you try :

 | datamodel Windows_Security_Event_Management Account_Management_Events search

rajim
Path Finder

Yes it's working. Thank you.

So we don't need to refer the parent datamodel. right?
Also if I have another child data model of Account_Management_Events, then also is it fine to refer that data model after the data model id?

0 Karma

p_gurav
Champion

Yes you can directly search after datamodel name, because according to documents datamodel command only take 1 dataset name. Refer this doc:
http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Datamodel

rajim
Path Finder

Thank you...
I had seen that document. there is "[ ]" enclosing the data set in that document. So I thought there might be multiple datasets. Anyway, thank you for your answer.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...