I am trying to create a new field using the regex i create.
I created a regex first in the first level
now how can i use that regex /calculated field in a eval expression ?
Solution in this question may help you:
https://answers.splunk.com/answers/526197/perform-math-on-data-model-objects-calculated-eval.html
I see this : https://answers.splunk.com/answers/329479/is-there-a-way-for-one-calculated-field-to-pull-da.html#an...
but its way back 2015 , does new splunk can do this now ?
Yea, you can utilized the extracted field from rex, in your next eval. The following should output 1, 2
| makeresults | eval field1="test1" | rex field=field1 "test(?<fieldcount>\d)" | eval field2=fieldcount+1 | table fieldcount, field2
would this apply in a data model ?