Reporting

Doing join of data model child objects

kamalm1
Explorer

Data Model Name Child Objects Property Values Property Values
datamodel1

childobject1 Description RequestID

record1 r1
record2 r2
record3 r3

childobject2    LogoutTime      RequestID   
        10:00 PM        r2
        11:00 PM        r3

Final output required as through search query not in data model RequesID Description LogoutTime

r1 record1

r2 record2 10:00 PM

r3 record3 11:00 PM

Tags (1)
0 Karma

kamalm1
Explorer

| datamodel search | fields + "field1" "field2" join type=left field1 [| datamodel search | fields + "field1"] | fields + "field1" "field2"

Above solution is verified and working.

0 Karma

MuS
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...