Splunk Search

Data model - eval expression

jeradb
Explorer

I can run the below command in a search successfully - 

 

| eval message=replace(Message, "^Installation Successful: Windows successfully installed the following update: ", "") 

 

 How can I convert this to work in a data model?   Below is my base search sample result. 

Message=Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.405.28.0) - Current Channel (Broad)

In my data model I would like to use eval expression on the field message and take off - Installation Successful: Windows successfully installed the following update: 

Desired results - 

Message= Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.405.28.0) - Current Channel (Broad)

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jeradb ,

as @richgalloway said, you should add in your Data Model, a new calculated field using your eval.

Remember that you have to rebuild the Data Model, otherwise the new calculated field will be available only from the time when you added it.

Ciao.

Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you edited the data model to create a new calculated field using your eval command?  That should do it.

Be warned, however, that once you modify a DM you own it.  Your copy will override any changes delivered by Splunk.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...