How to use a data model to create a timechart plotting the count of events with a dynamic drilldown to a table?

[snemiro_514]

Hi splunkers,

I started reading about data models, but I think I'm not getting the concept.

In my case, I have events describing transactions.

In my Data Model, I've defined an root object called "Transactions", with the proper source. Then, I've defined several child objects, "Success", "Error-Invalid data", "Error-DB connection" and "Error-Timeout" using contraints.

Now, I would like to create a timechart and plot the count of those events, and a dynamic drilldown to a table, so when you click on any "Success" in the timechart, it shows the "Success" events in the table.

So my question is, how can this be achieved?

I'm doing something similar with a search, but because we keep adding codes and redefining some transaction types, I would like to separate the taxonomy from the dashboard. I had to rewrite 11 new conditions because a new ErrorCode=E077 was now considered part of "Error - Invalid Data"....and I would like to use the data model instead.

Thanks!

[snemiro_514 · Accepted solution]

It was very simple.... I've decided to create an Eval field in the data model, and then timechart that value.