topic Data model - eval expression in Splunk Search

Data model - eval expression

jeradb — Thu, 15 Feb 2024 20:28:35 GMT

I can run the below command in a search successfully -

| eval message=replace(Message, "^Installation Successful: Windows successfully installed the following update: ", "")

How can I convert this to work in a data model? Below is my base search sample result.

Message=Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.405.28.0) - Current Channel (Broad)

In my data model I would like to use eval expression on the field message and take off - Installation Successful: Windows successfully installed the following update:

Desired results -

Message= Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.405.28.0) - Current Channel (Broad)

Re: Data model - eval expression

richgalloway — Thu, 15 Feb 2024 21:14:21 GMT

Have you edited the data model to create a new calculated field using your eval command? That should do it.

Be warned, however, that once you modify a DM you own it. Your copy will override any changes delivered by Splunk.

Re: Data model - eval expression

gcusello — Fri, 16 Feb 2024 06:05:26 GMT

Hi @jeradb ,

as @richgalloway said, you should add in your Data Model, a new calculated field using your eval.

Remember that you have to rebuild the Data Model, otherwise the new calculated field will be available only from the time when you added it.

Ciao.

Giuseppe