Fillnull value directly in Data Model

[SIEMStudent]

Hi Spunkers, I have a request by customer never faced before.

For one particular Data Model, the Email one, it is required that certaine filed are always populated, even if the logs have this fields empty and/or are not present. So for example it is required that the field subject is always filled; of course, if subject is not present in events, we have to fill it with a token, like the fillnullvalue function does.

The particular part is that the customer required that this filling is performed not at search time, with a fillnull command in search, but by the Data Model itself; so, for example, if a log from mail server arrive and it not contain the subject field and/or it is not populated, the DM must fill it with a token value and so, when a search is executed, subject will be already filled with this token.

My question is: is this possible to perform?

[SIEMStudent · Accepted solution]

Solved by myself: the point is switch from extracted field to a calculated field.