I have a data model with a fairly simple definition (see below), and I have accelerated it. When I get any information using tstats, I have to give a qualified name for the field, e.g.
| tstats count from datamodel=foo_data_model groupby All_Foo_Events.field1
but when I'm trying to work with the events themselves, I need to use the unqualified name, e.g.
index=foo | stats count by field1
Is there any way to define the data model so that I don't need use qualified names for everything, even on the top level object?
The current data model definition looks something like this:
{
"modelName": "foo_data_model",
"objectSummary": {
"Interfaces": 0,
"Interface Implementations": 0,
"Search-Based": 0,
"Transaction-Based": 0,
"Event-Based": 2
},
"displayName": "foo_data_model",
"objects": [
{
"comment": "",
"calculations": [],
"displayName": "All Foo Events",
"objectName": "All_Foo_Events",
"parentName": "BaseEvent",
"fields": [
{
"comment": "",
"fieldName": "field1",
"displayName": "field1",
"multivalue": false,
"hidden": false,
"required": false,
"type": "string"
},
...
... View more