[MODEL: dataset="microsoft_dhcp_raw"]
alter
    xdm.event.description = description,
    xdm.source.ipv4 = ipAddress,
    xdm.source.host.hostname = hostName,
    xdm.source.host.mac_addresses = arraycreate(coalesce(macAddress,"")),
    xdm.source.user.username = userName,
    xdm.source.identity.username = userName,
    xdm.event.operation_sub_type = id,
    xdm.session_context_id = transactionID,
    xdm.event.outcome = if(qResult="6",XDM_CONST.OUTCOME_SUCCESS ,qResult="0",XDM_CONST.OUTCOME_SUCCESS,XDM_CONST.OUTCOME_FAILED),
    xdm.event.outcome_reason = if(qResult="6","No Quarantine",qResult="0","NoQuarantine",qResult="1", "Quarantine", qResult="2", "Drop Packet", qResult="3", "Probation",qResult),
    xdm.target.host.hostname = json_extract_scalar(fb_host,"$.hostname"),
    xdm.target.ipv4 = arrayindex(regextract(to_string(json_extract(fb_host, "$.ip")), "(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"), 0),
    xdm.target.ipv6 = arrayindex(regextract(to_string(json_extract(fb_host, "$.ip")), "([a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5}[a-fA-F0-9\:]{1,5})"), 0);