Implementing Splunk 7, Third Edition - Third Edition

Children

We have just added a root (or parent) object to our data model. The next step is to add some children. Although a child object inherits all the constraints and attributes from its parent, when you create a child, you will give it additional constraints with the intention of further filtering the dataset that the object represents.

To add a child object to our data model, click on Add Field and select Child:

Splunk then opens the editor window, Add Child Dataset (shown in the following screenshot):

On this page, follow these steps: ...