Splunk Search

Is it possible to use where command in Data Model?

wilhelmF
Path Finder

I have datamodel and I want to create a child datamodel based on a field comparison. In a normal search I would use a where command but in the constraints I only can use a search command. My question is there a way to do it without an eval expression in a field?

0 Karma

Yunagi
Communicator

How about you create a calculated field under Settings/Fields? Something like:

Name: match
Eval expression: if(field1==field2,"yes","no")

Then you can create your child datamodel based on the constraint:

match="yes"

DalJeanis
Legend

@Yunagi - This is a correct way to go about this, although it does not meet OP's requirement of not having an eval in a field.

@wilhelmf - Not sure what your reason for not wanting the eval field. If you are just worrying about complicating the data model from a user's point of view, then you can hide the calculated field.

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...