Splunk Search

using data model qualified names

rettops
Path Finder

I have a data model with a fairly simple definition (see below), and I have accelerated it. When I get any information using tstats, I have to give a qualified name for the field, e.g.


| tstats count from datamodel=foo_data_model groupby All_Foo_Events.field1

but when I'm trying to work with the events themselves, I need to use the unqualified name, e.g.

index=foo | stats count by field1

Is there any way to define the data model so that I don't need use qualified names for everything, even on the top level object?

The current data model definition looks something like this:


{
"modelName": "foo_data_model",
"objectSummary": {
"Interfaces": 0,
"Interface Implementations": 0,
"Search-Based": 0,
"Transaction-Based": 0,
"Event-Based": 2
},
"displayName": "foo_data_model",
"objects": [
{
"comment": "",
"calculations": [],
"displayName": "All Foo Events",
"objectName": "All_Foo_Events",
"parentName": "BaseEvent",
"fields": [
{
"comment": "",
"fieldName": "field1",
"displayName": "field1",
"multivalue": false,
"hidden": false,
"required": false,
"type": "string"
},
...

Tags (2)
0 Karma

dlamas_splunk
Splunk Employee
Splunk Employee

Take a look at the pivot search command.

Pivot Command Docs

Field lineage is used to prevent name collisions. Since the Pivot command specifies an object, you can use fieldName sans qualification. If the Data Model is accelerated, it will build the tstats query for you. You can get an idea of how to build | pivot searches by using the UI and then clicking "Open in Search."

Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...