Splunk Enterprise Security

EnterpriseSecurity - DataModels


Hi everyone,


We have Palo Alto products, and we have also installed the appropriate add-on and apps. We mapped the data into the data models and the relevant data model for my question is the Web data model .

There is a field called dest in the DM, and for datamodel web (for palo alto) i need its value to be "dest_hostname" (the current value is "dest_ip"). The current value is relevant for the Network Traffic DM, therefore i don't want to change it. 


Is it OK to add additional fields to the built-in data models of Splunk ES, or is it not recommended? 

What are the downsides of action like this? 


Thanks ! 

Labels (1)
0 Karma


Don't add fields to a DM unless absolutely necessary.  In your case, you should be able to add the dest field by creating a new field alias that maps dest_ip to dest.

If this reply helps you, Karma would be appreciated.
0 Karma


Hi @richgalloway ,

Thanks for the fast reply.

It is a bit problematic, as there is already a mapping from dest_ip to dest which is relevant for the "Network Traffic" data model. I need  the dest in Web data model to contain values from dest_hostname and not dest IP (for palo alto).

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...