Reporting

How to extract new fields from a datamodel without deaccelearting it?

abhi04
Communicator

Hi All,

I have a datamodel "Authentication". This datamodel is already been accelerated.I require two more fields to be extracted from this datamodel. I have used the below query for excessive logins but does not seems to give results. Please advice.

| from datamodel:"Authentication"."Failed_Authentication"
| rex field=_raw "Result Code:\s+(?.*)"
| rex field=_raw "EventCode=(?\d+)"
| search 'event_code'=4768 AND 'result_code'=0x17
| stats dc(dest) as "dest_count",dc(user) as "user_count" ,count by "app","user"

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

One cannot add fields to a datamodel while it is accelerated. The UI should make that clear.

It is possible to extract additional fields from those returned by a data model. I'm unaware, however, of any datamodel that produces a field called "_raw".

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

One cannot add fields to a datamodel while it is accelerated. The UI should make that clear.

It is possible to extract additional fields from those returned by a data model. I'm unaware, however, of any datamodel that produces a field called "_raw".

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...