How to add condition in splunk data model constraint

Question

I have a outbound flow that gets data written by App, mem and cards api. cards and mem api is writing logs into applog but App is writing logs in syslog.

In my data model I have sourcetype=app_log as the source type. So in case of all flows except app I am getting write splunk dashboard report but for application I am not getting any data.

So I want to add a condition in data model "constraint" section like when api is applications then sourcetype=app_log OR sourcetype=sys_log else sourcetype=app_log

Can anyone assist me how to do this in splunk?

Answer 1

If you need a dual sourcetype, it's usually best to make that part of the root search/event to draw in all relevant data you would like to use in your data model.

A data model is like sheering away wood on a sculpture, so if it's usually better to start with all of the data, and then slowly pick away at what you want to see.

You can add | where clauses as constraints, however you can't add more data if you don't start with it in the root events.

my suggestion would be something like this in your root search:

(index=index1 sourcetype=sourcetype1) OR (index=index2 sourcetype=sourcetype2) field=blah field=blah ....