I try use macros to get external indexes in child dataset VPN, but search with tstats on this dataset doesn't work. Example of search:
| tstats values(sourcetype) as sourcetype from datamodel=authentication.authentication where nodename=authentication.VPN by nodename
But when I explicitly enumerate the indexes, then everything works! And also it work with macros when i use search:
| from datamodel ...
What's problem?
If you use the pivot interface and select the VPN child do you get results?
Can you try this?
| tstats prestats=true summariesonly=false allow_old_summaries=true values(sourcetype) as sourcetype FROM datamodel=Authentication WHERE nodename=Authentication.VPN
| stats dedup_splitvals=t values(sourcetype)