In my data model, I have a number of calculated fields that are derived from an Eval Expression. As the same expression is needed in multiple Data Model's, I'm starting to see some repeated logic. Is it possible for me to declare a function globally that each of my Data Model's expressions fields can access.
So instead of the following in my Expression:
if( 'some_node' = "YES" or 'some_other_node' = "YES", "true", "false")
I would have
if(myFunction(some_node,some_other_node)
Thanks.
You can create macros and use them in your expression -
docs.splunk.com/Documentation/Splunk/6.2.3/Search/Usesearchmacros
For e.g.
macro name : my_strptime(1)
definition : eval $field$=round(strptime($field$, "%m/%d/%Y:%H:%M:%S"), 0)
So any 'time' field that you pass to the macro by calling " | my_strptime(my_time_field)
", will be processed in this format.
Can this macros be applied to the calculated fields in the data model (not in the actual query as this is created by the pivots) ?