Hi everyone, I am currently working with creating data models for Splunk App. For this app, I am planning to design one main Dataset, with multiple child datasets. These child Datasets, are at the equal level, and might have the fields with same name.  Please note that all the fields are evaluated at the Child dataset level and not at the Root dataset. Also, the type of events in different child datasets might be different, that is, in one child it might be syslog, in another child, it might be JSON, etc. It looks something like this: Datamodel: Datamodel_Test Root Dataset: Root (index IN (main)) Child Dataset: Child1 (sourcetype="child1") Category Severity Name1 Child Dataset: Child2 (sourcetype="child2") Severity Name Root Dataset: Root2 (index IN main) Main questions: Severity is not available in Child2 (| tstats summariesonly=false values(Root.Child2.Severity) from datamodel=Datamodel_Test where nodename=Root.Child2) Name is available in Child2 as it's renamed to Name1 in Child1 (| tstats summariesonly=false values(Root.Child2.Name) from datamodel=Datamodel_Test where nodename=Root.Child2) Also, Root2 is not available as a root datamodel by the query and it's not showing any events. (| tstats summariesonly=false count as Count from datamodel=Datamodel_Test by nodename) We tried different things to get through, though we are stuck at this issue.  Is this an expected behavior or a bug in Splunk? ... View more