Splunk Search

using data model qualified names

Path Finder

I have a data model with a fairly simple definition (see below), and I have accelerated it. When I get any information using tstats, I have to give a qualified name for the field, e.g.

| tstats count from datamodel=foo_data_model groupby All_Foo_Events.field1

but when I'm trying to work with the events themselves, I need to use the unqualified name, e.g.

index=foo | stats count by field1

Is there any way to define the data model so that I don't need use qualified names for everything, even on the top level object?

The current data model definition looks something like this:

"modelName": "foo_data_model",
"objectSummary": {
"Interfaces": 0,
"Interface Implementations": 0,
"Search-Based": 0,
"Transaction-Based": 0,
"Event-Based": 2
"displayName": "foo_data_model",
"objects": [
"comment": "",
"calculations": [],
"displayName": "All Foo Events",
"objectName": "All_Foo_Events",
"parentName": "BaseEvent",
"fields": [
"comment": "",
"fieldName": "field1",
"displayName": "field1",
"multivalue": false,
"hidden": false,
"required": false,
"type": "string"

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

Take a look at the pivot search command.

Pivot Command Docs

Field lineage is used to prevent name collisions. Since the Pivot command specifies an object, you can use fieldName sans qualification. If the Data Model is accelerated, it will build the tstats query for you. You can get an idea of how to build | pivot searches by using the UI and then clicking "Open in Search."

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...