Knowledge Management

datamodel command for multilevel data model child datasets

rajim
Path Finder

I want to run datamodel command to fetch the results from a child dataset which is part of a datamodel as shown in the attached screenshot. I am using the below query. But unfortunately it's not returning error. Can anybody please help me write the correct query for multilevel child dataset.

| datamodel Windows_Security_Event_Management Windows_Security_Events Account_Management_Events search

Error message:
Error in 'datamodel' command: Invalid argument: 'search'

alt text

0 Karma
1 Solution

p_gurav
Champion

Hi,

Can you try :

 | datamodel Windows_Security_Event_Management Account_Management_Events search

View solution in original post

p_gurav
Champion

Hi,

Can you try :

 | datamodel Windows_Security_Event_Management Account_Management_Events search

rajim
Path Finder

Yes it's working. Thank you.

So we don't need to refer the parent datamodel. right?
Also if I have another child data model of Account_Management_Events, then also is it fine to refer that data model after the data model id?

0 Karma

p_gurav
Champion

Yes you can directly search after datamodel name, because according to documents datamodel command only take 1 dataset name. Refer this doc:
http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Datamodel

rajim
Path Finder

Thank you...
I had seen that document. there is "[ ]" enclosing the data set in that document. So I thought there might be multiple datasets. Anyway, thank you for your answer.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...