Want to add the below logic in the datamodel and use with tstats
| eval _raw=replace(_raw,"\","null") |rex "NetworkSetting>International\sRoaming\sBar(?s).?<.?NewValue>(?[^<]*)"
You can refer this doc:
https://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Addaregularexpressionattribute
Adding simple fields is fine but i want to add this replace logic in my dashboards and then use the same with my tstats query