Use the '| from datamodel' command when the datamo...

Splunk Search

I want to query the user dataset using the from datamodel command.
I know how to use nodename in the tstat command.

When I run SPL as shown below, an error appears.

| from datamodel: test_01.evtid.user

If you know how, please reply.

Get Updates on the Splunk Community!

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Use the '| from datamodel' command when the datamodel is configured as grandparent/parent/child.