I have a data model with a fairly simple definition (see below), and I have accelerated it. When I get any information using tstats, I have to give a qualified name for the field, e.g.
| tstats count from datamodel=foo_data_model groupby All_Foo_Events.field1
index=foo | stats count by field1
The current data model definition looks something like this:
{
"modelName": "foo_data_model",
"objectSummary": {
"Interfaces": 0,
"Interface Implementations": 0,
"Search-Based": 0,
"Transaction-Based": 0,
"Event-Based": 2
},
"displayName": "foo_data_model",
"objects": [
{
"comment": "",
"calculations": [],
"displayName": "All Foo Events",
"objectName": "All_Foo_Events",
"parentName": "BaseEvent",
"fields": [
{
"comment": "",
"fieldName": "field1",
"displayName": "field1",
"multivalue": false,
"hidden": false,
"required": false,
"type": "string"
},
...
Take a look at the pivot search command.
Field lineage is used to prevent name collisions. Since the Pivot command specifies an object, you can use fieldName sans qualification. If the Data Model is accelerated, it will build the tstats query for you. You can get an idea of how to build | pivot searches by using the UI and then clicking "Open in Search."