Hi,
I am trying to use data model as I have large dataset to accelerate dashboards I use.
So I have 3 lvl hierarchy where I filter each subsequent data level by constraint.
To be precise first level filters by index, second by source name and third by further filtering the sources.
The problem is that at this third level I am not getting data accordingly to last condition.
example: lvl 1 index sql
lvl2 source:tech0*
lvl3 source:tech02
so at lvl3 I should be able to see field FreeSpace_in_MB and Drive but they are missing. It almost seems like splunk isnt able to extract all the fields at once an then divide them correctly.
in fact in all levels I am getting the same fields. Are these fields not supposed to be distributed to respective datasets by constraint I set ?
Thank you for answer
