Reporting

Doing join of data model child objects

kamalm1
Explorer

Data Model Name Child Objects Property Values Property Values
datamodel1

childobject1 Description RequestID

record1 r1
record2 r2
record3 r3

childobject2    LogoutTime      RequestID   
        10:00 PM        r2
        11:00 PM        r3

Final output required as through search query not in data model RequesID Description LogoutTime

r1 record1

r2 record2 10:00 PM

r3 record3 11:00 PM

Tags (1)
0 Karma

kamalm1
Explorer

| datamodel search | fields + "field1" "field2" join type=left field1 [| datamodel search | fields + "field1"] | fields + "field1" "field2"

Above solution is verified and working.

0 Karma

MuS
Legend
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...