Creating an attribute based on a regular expression

Now, we are going to create an attribute based on a regular expression, which is a specialized text string that describes a search pattern. What we want to do is extract the airport code that is part of the Destination Details URI:

http_uri="/destination/MIA/details" 

To do this, we have to create an attribute in the Destination Details child. Follow these steps:

1. Select Destination Details, click on the Add Field dropdown, and select Regular Expression.
2. In the Regular Expression field, type in the following text:

/destination/(?<AirportCode>.+?)/details 

3. Click on the blank area outside the text box to populate the field, as shown in the following screenshot.
4. Change the display name to Airport Code:

Regular Expression

5. Click on Preview and make sure that the airport codes are highlighted in the events. You can also click the Airport Code tab to see them summarized:

Airport Code tab

6. Click the Non-Matches button and ensure that no events are shown.
7. Click on Save to proceed.

Now that you have built your first data model, it is time to prepare it for use in Pivot. Here are the steps to perform:

1. Change the permission of the data model so that all other Splunk users can use it in the context of the Destinations app. On the Edit dropdown, select Edit Permissions:

2. Change the permission of the data model so that it is available for the Destinations app. Click on App on the Display For button set.
3. Set the Read permission to Everyone and the admin group to Write:

4. Click on Save to continue. In the next section, we will introduce you to data model acceleration and how to enable it.