Splunk Enterprise Security

What is the use drop_dm_object_name() clause in a query with tstats.?

New Member

I am trying to find out what purpose drop_dm_object_name() serves.

0 Karma

Splunk Employee
Splunk Employee

That macro just changes the name of fields in data models to be just the field name, instead of the relative name in the data model. So a dataset would go from: Authentication.user to just "user" after using that macro.

0 Karma

New Member

what is macro?

0 Karma

Path Finder

@Jishnukn10 - 

Search macros in Splunk are reusable chunks of Search Processing Language (SPL) that you can insert into other searches. It's enclosed within acute/back quotes `macro_name` on your search like  `drop_dm_object_name(field)`. You can see these macros in Splunk and define them under Settings > Advanced Search > Search Macros.

All about macros here : 

Use search macros in searches - Splunk Documentation

Hope this helps. 

0 Karma

Path Finder

A macro is a rule that shows how a certain input should be mapped to a replacement output

To expand a macro in splunk - use CTRL + SHIFT + e

And to OP - drop_dm_object_name removes the leading stuff from a data model.
DM fields (not index, host, sourcetype etc) but the ones you create as custom all have leading words infront of the field.
In a typical authentication DM for example all the fields have a leading "Authentication." prefix.
Authentication.user, Authentication.tag, Authentication.app etc.
drop_dm_object just drops the "Authentication." part.




Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...