Splunk Search

Why are the field names different when using |from datamodel instead of |datamodel in a search?

smoir_splunk
Splunk Employee
Splunk Employee

When I do a search with |from datamodel, the search results are the same as when I do a search with |datamodel, but the field names are different:

|from datamodel:Authentication.Successful_Authentication | table *
returns field names like src, dest, action

and
|datamodel Authentication Successful_Authentication search | table *
returns field names like Authentication.src, Authentication.dest, and Authentication.action.

Why are the field names different in the search results?

0 Karma
1 Solution

smoir_splunk
Splunk Employee
Splunk Employee

The |from command flattens the data model hierarchy, so the field names are the same but are no longer prefaced by the hierarchical syntax like with the |datamodel command, so you get just dest or src instead of Authentication.dest or Authentication.src

View solution in original post

smoir_splunk
Splunk Employee
Splunk Employee

The |from command flattens the data model hierarchy, so the field names are the same but are no longer prefaced by the hierarchical syntax like with the |datamodel command, so you get just dest or src instead of Authentication.dest or Authentication.src

woodcock
Esteemed Legend

The |from command uses the datamodel constraints in regular search so you get them without the field names whereas the |datamodel command actually uses the full datamodel framework so you get the prefixes and other things.

smoir_splunk
Splunk Employee
Splunk Employee

(sorry I waited too long to answer my own question!)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...