We all know that foreach * will work on all the fields in the result row right... Well it seems that when using datamodels, the wildcard for fields is not what it seems | from datamodel:DataMode...
See more...
We all know that foreach * will work on all the fields in the result row right... Well it seems that when using datamodels, the wildcard for fields is not what it seems | from datamodel:DataModelName
| foreach * [ eval field_list=mvappend(field_list, "<<MATCHSTR>>") ]
| table field_list, * _raw With the above running on a suitably populated data model, the wildcard in the foreach and the one in the table statement give a different set of fields - but not always. The foreach * will normally show the data seen in the backing event mapped onto the data model, whereas the table * will show the datamodel fields names, even if those fields are null. However, I have run searches today, where the foreach statement is actually getting fields from the datamodel, where the fields do not exist in the data. It's Splunk 7.3.4. I have run these two searches which give different results, which are even stranger. | from datamodel:Performance.CPU
| head 1
| foreach * [ eval field_list=mvappend(field_list, "<<MATCHSTR>>") ]
| table field_list, * _raw | from datamodel:Performance.CPU
| foreach * [ eval field_list=mvappend(field_list, "<<MATCHSTR>>") ]
| table field_list, * _raw
| head 1 The first one gives me field_list containing all the fields from the Performance.CPU data model, including the inherited ones, such as hypervisor_id, but which are null and are definitely not in the data, whereas the second one just gives me a smaller list of the non null fields in the data model. However, the _raw data is the same in both cases. Does anyone know what * should mean when dealing with data models and should it work the same in both foreach and table cases.