topic Re: Datamodel accelerated - where Calculated Fields definition is saved? in Knowledge Management

Datamodel accelerated - where calculated fields definition is saved?

edoardo_vicendo — Wed, 13 Jul 2022 19:47:12 GMT

Hello,

I have in the "Network_Traffic.All_Traffic" a Calculated Field called "rule".

The Datamodel is accelerated, therefore the eval expression is not editable from Web UI and I cannot see the expression to extract/calculate the field.

I tried searching in all the *.conf files but I do not find it, I was expecting to find it on a props.conf

I know the workaround is to temporary disable the acceleration, so that the calculated field becomes editable and I can see how it is calculated, but I would like to avoid doing that.

Is there any other way to do that OR do you know where the Datamodel Calculated Fields are saved?

Thanks a lot,

Edoardo

Re: Datamodel accelerated - where Calculated Fields definition is saved?

diogofgm — Wed, 13 Jul 2022 17:21:47 GMT

the data models definitions are stored inside <yourapp>/default/data/models. You can find there a json file with all data model definitions

Re: Datamodel accelerated - where Calculated Fields definition is saved?

richgalloway — Wed, 13 Jul 2022 17:22:22 GMT

Another workaround is to clone the datamodel and examine the calculated fields in the clone.

The calculation itself is stored in the datamodel description file in $SPLUNK_HOME/etc/apps/Splunk_SA_CIM/default/data/models/Network_Traffic.json

Re: Datamodel accelerated - where Calculated Fields definition is saved?

PickleRick — Wed, 13 Jul 2022 17:45:53 GMT

As an additional piece of info - you can look into the json files to see the definitions. In some cases (like two different search heads (or shclusters) sharing the same indexer cluster) you can copy the definitions over but you should not edit the jsons by hand but rather use splunk's webui to define own datamodels since splunk does some level of validation "underneath".