Use the '| from datamodel' command when the datamo...

Splunk Search

I want to query the user dataset using the from datamodel command.
I know how to use nodename in the tstat command.

When I run SPL as shown below, an error appears.

| from datamodel: test_01.evtid.user

If you know how, please reply.

Get Updates on the Splunk Community!

December 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with this ...

Hello Splunk Community, We're thrilled to share an exciting update that will help you manage your data more ...

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...

Use the '| from datamodel' command when the datamodel is configured as grandparent/parent/child.