Data model - eval expression

[jeradb]

I can run the below command in a search successfully - 

| eval message=replace(Message, "^Installation Successful: Windows successfully installed the following update: ", "") 

 How can I convert this to work in a data model?   Below is my base search sample result. 

Message=Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.405.28.0) - Current Channel (Broad)

In my data model I would like to use eval expression on the field message and take off - Installation Successful: Windows successfully installed the following update: 

Desired results - 

Message= Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.405.28.0) - Current Channel (Broad)

[gcusello]

Hi @jeradb ,

as @richgalloway said, you should add in your Data Model, a new calculated field using your eval.

Remember that you have to rebuild the Data Model, otherwise the new calculated field will be available only from the time when you added it.

Ciao.

Giuseppe

[richgalloway]

Have you edited the data model to create a new calculated field using your eval command?  That should do it.

Be warned, however, that once you modify a DM you own it.  Your copy will override any changes delivered by Splunk.