Hi, this is my first posting to this community I believe.  I am trying to add a new field called uri_path to an existing data model called Web. The only thing in the constraint is index=web. Names have been changed in this posting. One of the fields in the DM is url which is used to extract the url_path (different name here) via the URLParser scripted lookup. https://splunkbase.splunk.com/app/3396/#/details The above link says this below: "Scripted Lookup URLParser is also accessible as a scripted lookup. This will be useful for situations where the custom search command cannot be used like if you are building a datamodel. The scripted lookup is slower than the custom search command. ... | eval list="iana|mozilla" | lookup urlparser_lookup url list" The following SPL works great: index=web  | head 200 | eval list="iana|mozilla" | lookup urlparser_lookup url list | table url_path | eval uri_path=url_path My question is, how do you make this work when trying to add a new field called (uri_path) to the Web  DM? If I try to add the below as a calculated field using an Eval Expression, it doesn't work. There are errors related to searching the index when I try search the DM. If I remove the new field, the Dm search works fine again. Should the index line go here before the eval expression? I am thinking it shouldn't. | eval list="iana|mozilla" | lookup urlparser_lookup url list | table url_path | eval uri_path=url_path I am thinking maybe a lookup definition is needed to try it that way when adding a new field, but when I search for a file called urlparser_lookup, no file is found. It does not show up in the adding new field drop-down list for adding a new field using lookup either. I can't create a lookup definition if I can't find the lookup file. I am not sure how to implement this. Any help will be much appreciated. Regards ... View more