Splunk Search

How to join multiple child objects of a data model?

sanjay_shrestha
Contributor

We have a situation where we need to join multiple child objects of a data model.

e.g.

 ProjectInformation (Datamodel Object)
                                 _time
                                 host
                                ..........

             ChildOne (Datamodel Child Object)
                                 _time
                                 host
                                ............
                                field1
                                CalculatedField2

             ChildTwo(Datamodel Child Object)
                                 _time
                                 host                               
                                ............
                                 field 1
                                CalculatedField3
             ChildThree(Datamodel Child Object)
                                 _time
                                 host                               
                                ............          
                                CalculatedField3
                                CalculatedField4

We would like to have a result with following fields:

   CalculatedField2; CalculatedField3; CalculatedField4 by field1

where field1 value for ChildThree should be evaluated from ChildTwo.field 1 where ChildTwo.CalculatedField2 = ChildThree.CalculatedField2

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Can you define all of the calculated fields at the top level data model?

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...