Splunk Search

How to use inherited fields in child dataset ?

AKG1_old1
Builder

Hello,

I am using child dataset in data model. Not sure how to use fields which are inherited from parent data model. I am able to access only calculated fields which are created in child dataset.

Search I am trying:

| tstats values(qcst.BA.Duration_sec) AS Duration_sec values(qcst.BA.Duration) AS Duration values(qcst.BA.ActivityType) AS ActivityType FROM datamodel=MTE_RUNTIME_BETA by _time

alt text

alt text

0 Karma

edomeie
Observer

did you ever figure this out? I am having the same issue.

0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...