using data model qualified names

[rettops]

I have a data model with a fairly simple definition (see below), and I have accelerated it. When I get any information using tstats, I have to give a qualified name for the field, e.g.

| tstats count from datamodel=foo_data_model groupby All_Foo_Events.field1

but when I'm trying to work with the events themselves, I need to use the unqualified name, e.g.

index=foo | stats count by field1

Is there any way to define the data model so that I don't need use qualified names for everything, even on the top level object?

The current data model definition looks something like this:

{

    "modelName": "foo_data_model", 

    "objectSummary": {

        "Interfaces": 0, 

        "Interface Implementations": 0, 

        "Search-Based": 0, 

        "Transaction-Based": 0, 

        "Event-Based": 2

    }, 

    "displayName": "foo_data_model", 

    "objects": [

        {

            "comment": "", 

            "calculations": [], 

            "displayName": "All Foo Events", 

            "objectName": "All_Foo_Events", 

            "parentName": "BaseEvent", 

            "fields": [

                {

                    "comment": "", 

                    "fieldName": "field1", 

                    "displayName": "field1", 

                    "multivalue": false, 

                    "hidden": false, 

                    "required": false, 

                    "type": "string"

                },

                ...

[dlamas_splunk]

Take a look at the pivot search command.

Pivot Command Docs

Field lineage is used to prevent name collisions. Since the Pivot command specifies an object, you can use fieldName sans qualification. If the Data Model is accelerated, it will build the tstats query for you. You can get an idea of how to build | pivot searches by using the UI and then clicking "Open in Search."