Reporting

Doing join of data model child objects

kamalm1
Explorer

Data Model Name Child Objects Property Values Property Values
datamodel1

childobject1 Description RequestID

record1 r1
record2 r2
record3 r3

childobject2    LogoutTime      RequestID   
        10:00 PM        r2
        11:00 PM        r3

Final output required as through search query not in data model RequesID Description LogoutTime

r1 record1

r2 record2 10:00 PM

r3 record3 11:00 PM

Tags (1)
0 Karma

kamalm1
Explorer

| datamodel search | fields + "field1" "field2" join type=left field1 [| datamodel search | fields + "field1"] | fields + "field1" "field2"

Above solution is verified and working.

0 Karma

MuS
Legend
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...