Knowledge Management

Datamodel accelerated - where calculated fields definition is saved?

edoardo_vicendo
Contributor

Hello,

I have in the "Network_Traffic.All_Traffic" a Calculated Field called "rule".

The Datamodel is accelerated, therefore the eval expression is not editable from Web UI and I cannot see the expression to extract/calculate the field.

I tried searching in all the *.conf files but I do not find it, I was expecting to find it on a props.conf

I know the workaround is to temporary disable the acceleration, so that the calculated field becomes editable and I can see how it is calculated, but I would like to avoid doing that.

Is there any other way to do that OR do you know where the Datamodel Calculated Fields are saved?

Thanks a lot,

Edoardo

Labels (2)
0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

the data models definitions are stored inside <yourapp>/default/data/models. You can find there a json file with all data model definitions

------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

As an additional piece of info - you can look into the json files to see the definitions. In some cases (like two different search heads (or shclusters) sharing the same indexer cluster) you can copy the definitions over but you should not edit the jsons by hand but rather use splunk's webui to define own datamodels since splunk does some level of validation "underneath".

richgalloway
SplunkTrust
SplunkTrust

Another workaround is to clone the datamodel and examine the calculated fields in the clone.

The calculation itself is stored in the datamodel description file in $SPLUNK_HOME/etc/apps/Splunk_SA_CIM/default/data/models/Network_Traffic.json

 

---
If this reply helps you, Karma would be appreciated.

diogofgm
SplunkTrust
SplunkTrust

the data models definitions are stored inside <yourapp>/default/data/models. You can find there a json file with all data model definitions

------------
Hope I was able to help you. If so, some karma would be appreciated.
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...