Use the '| from datamodel' command when the datamo...

Splunk Search

I want to query the user dataset using the from datamodel command.
I know how to use nodename in the tstat command.

When I run SPL as shown below, an error appears.

| from datamodel: test_01.evtid.user

If you know how, please reply.

Get Updates on the Splunk Community!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

Use the '| from datamodel' command when the datamodel is configured as grandparent/parent/child.