Reporting

Doing join of data model child objects

kamalm1
Explorer

Data Model Name Child Objects Property Values Property Values
datamodel1

childobject1 Description RequestID

record1 r1
record2 r2
record3 r3

childobject2    LogoutTime      RequestID   
        10:00 PM        r2
        11:00 PM        r3

Final output required as through search query not in data model RequesID Description LogoutTime

r1 record1

r2 record2 10:00 PM

r3 record3 11:00 PM

Tags (1)
0 Karma

kamalm1
Explorer

| datamodel search | fields + "field1" "field2" join type=left field1 [| datamodel search | fields + "field1"] | fields + "field1" "field2"

Above solution is verified and working.

0 Karma

MuS
Legend
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...