Splunk Enterprise Security

What is the use drop_dm_object_name() clause in a query with tstats.?

Abhi89
New Member

I am trying to find out what purpose drop_dm_object_name() serves.

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

That macro just changes the name of fields in data models to be just the field name, instead of the relative name in the data model. So a dataset would go from: Authentication.user to just "user" after using that macro.

0 Karma

Jishnukn10
New Member

what is macro?

0 Karma

kkrises
Path Finder

@Jishnukn10 - 

Search macros in Splunk are reusable chunks of Search Processing Language (SPL) that you can insert into other searches. It's enclosed within acute/back quotes `macro_name` on your search like  `drop_dm_object_name(field)`. You can see these macros in Splunk and define them under Settings > Advanced Search > Search Macros.

All about macros here : 

Use search macros in searches - Splunk Documentation

Hope this helps. 

0 Karma

Keysofsandiego
Path Finder

A macro is a rule that shows how a certain input should be mapped to a replacement output

To expand a macro in splunk - use CTRL + SHIFT + e

And to OP - drop_dm_object_name removes the leading stuff from a data model.
DM fields (not index, host, sourcetype etc) but the ones you create as custom all have leading words infront of the field.
In a typical authentication DM for example all the fields have a leading "Authentication." prefix.
Authentication.user, Authentication.tag, Authentication.app etc.
drop_dm_object just drops the "Authentication." part.

Cheers

 

 

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...