Knowledge Management

How to use specific dataset in case of multiple dataset in datamodel ?

AKG1_old1
Builder

Hello,

In our datamodel, we have multiple datasets (root events/ root search).
But only the 1st one is working in the tstat search.

In below example I have 3 datasets, only SERVICE dataset is working, if I remove SERVICE then BA_LIVEBOOK will work and if remove BA_LIVEBOOK as well then RISKENGINE will work.

Data Model Structure

alt text

Below search query is to access BA_LIVEBOOK dataset but it will work only if I remove SERVICE EVENT.
Is there a different way of access in case of multiple datasets?

| tstats values(BA_LIVEBOOK.NPID) as NPID FROM datamodel=SERVICE_V7 WHERE (nodename=BA_LIVEBOOK) GROUPBY source
0 Karma

DavidHourani
Super Champion

Hi @agoyal,

What are the populating searches for your root events/searches ?

If they are independent I would advise you to go ahead and build a separate DM for each of the root searches, a general rule of thumb would be to have a root search and then child searches to get the best performance and avoid the kind of issues you're having.

Cheers,
David,

0 Karma

AKG1_old1
Builder

data in different dataset are related but queries are different. I can't use as parent/child because I am using "|" in constraint which is not allowed in child. we have 4 datasets now and may get increase later. Managing would be eaiser to have single datamodel.

Anyway, My consern is If there is option of having mutliple datasets then I don't understand why we can't use like this. May be I am missing some property which require to call the dataset in search query.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...