Splunk Search

Data model - eval expression

jeradb
Explorer

I can run the below command in a search successfully - 

 

| eval message=replace(Message, "^Installation Successful: Windows successfully installed the following update: ", "") 

 

 How can I convert this to work in a data model?   Below is my base search sample result. 

Message=Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.405.28.0) - Current Channel (Broad)

In my data model I would like to use eval expression on the field message and take off - Installation Successful: Windows successfully installed the following update: 

Desired results - 

Message= Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.405.28.0) - Current Channel (Broad)

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jeradb ,

as @richgalloway said, you should add in your Data Model, a new calculated field using your eval.

Remember that you have to rebuild the Data Model, otherwise the new calculated field will be available only from the time when you added it.

Ciao.

Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you edited the data model to create a new calculated field using your eval command?  That should do it.

Be warned, however, that once you modify a DM you own it.  Your copy will override any changes delivered by Splunk.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...