Use the '| from datamodel' command when the datamo...

Splunk Search

I want to query the user dataset using the from datamodel command.
I know how to use nodename in the tstat command.

When I run SPL as shown below, an error appears.

| from datamodel: test_01.evtid.user

If you know how, please reply.

Get Updates on the Splunk Community!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

Use the '| from datamodel' command when the datamodel is configured as grandparent/parent/child.