Use the '| from datamodel' command when the datamo...

Splunk Search

I want to query the user dataset using the from datamodel command.
I know how to use nodename in the tstat command.

When I run SPL as shown below, an error appears.

| from datamodel: test_01.evtid.user

If you know how, please reply.

Get Updates on the Splunk Community!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud In today’s fast-paced digital ...

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Use the '| from datamodel' command when the datamodel is configured as grandparent/parent/child.