event code 39

[splunk_user9968]

I would like to create a search with data models where my event id is 39. However, there is no datamodel that fulfills my criteria. Is there anyone kn

[PickleRick]

There is no datamodel for this because datamodels abstract the event's conceptual side from the actual implementation. That's why your "event id being 39" is not a good condition for a CIM datamodel.

You can of course build your own datamodel but the question is what would you want to achieve with it. If you just want to find all events with this event id you can do so using normal event search (with some possible acceleration techniques).