Knowledge Management

How to use specific dataset in case of multiple dataset in datamodel ?

AKG1_old1
Builder

Hello,

In our datamodel, we have multiple datasets (root events/ root search).
But only the 1st one is working in the tstat search.

In below example I have 3 datasets, only SERVICE dataset is working, if I remove SERVICE then BA_LIVEBOOK will work and if remove BA_LIVEBOOK as well then RISKENGINE will work.

Data Model Structure

alt text

Below search query is to access BA_LIVEBOOK dataset but it will work only if I remove SERVICE EVENT.
Is there a different way of access in case of multiple datasets?

| tstats values(BA_LIVEBOOK.NPID) as NPID FROM datamodel=SERVICE_V7 WHERE (nodename=BA_LIVEBOOK) GROUPBY source
0 Karma

DavidHourani
Super Champion

Hi @agoyal,

What are the populating searches for your root events/searches ?

If they are independent I would advise you to go ahead and build a separate DM for each of the root searches, a general rule of thumb would be to have a root search and then child searches to get the best performance and avoid the kind of issues you're having.

Cheers,
David,

0 Karma

AKG1_old1
Builder

data in different dataset are related but queries are different. I can't use as parent/child because I am using "|" in constraint which is not allowed in child. we have 4 datasets now and may get increase later. Managing would be eaiser to have single datamodel.

Anyway, My consern is If there is option of having mutliple datasets then I don't understand why we can't use like this. May be I am missing some property which require to call the dataset in search query.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...