topic Re: Why do some searches only display statistics and not Events? in All Apps and Add-ons

Why do some searches only display statistics and not Events?

summitsplunk — Wed, 03 Jan 2018 21:20:18 GMT

Below is a screen shot from my Fortinet FortiGate App for Splunk. In this case I'm clicking the search "Threat By Severity" on the Threat Dashboard. I noticed that I cannot drill down to events and it's only showing "statistics".

Re: Why do some searches only display statistics and not Events?

elliotproebstel — Wed, 03 Jan 2018 21:30:56 GMT

The query in your screenshot starts with tstats, a generating command which returns statistical data based on analysis of the tsidx files, not the events themselves. More information about tstats can be found here:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Tstats
This answer also provides some good plain-English explanations of what tstats is:
https://answers.splunk.com/answers/186938/what-is-tstats-and-why-is-so-much-faster-than-stat.html

So basically, Splunk isn't analyzing regular events to generate the data shown on this screenshot, so it hasn't gathered those events for you to view.

Re: Why do some searches only display statistics and not Events?

summitsplunk — Wed, 03 Jan 2018 22:24:22 GMT

"So basically, Splunk isn't analyzing regular events to generate the data shown on this screenshot, so it hasn't gathered those events for you to view. "

Thanks for the explanation of tstats. So the more complicated question would be:

How do I get Splunk to analyze the regular events to generate the data shown?

Re: Why do some searches only display statistics and not Events?

elliotproebstel — Thu, 04 Jan 2018 14:26:14 GMT

I haven't used the Fortinet app on Splunk, so I'm just making some educated guesses based on the documentation I see on Splunkbase at https://splunkbase.splunk.com/app/2800/#/details

If you followed the default install, it looks like you should be able to find the events that are being used to populate the ftnt_fos data model by searching for sourcetype=fgt_traffic. (I'm basing this guess on step 5 in the documentation, where a screenshot shows a search for this sourcetype.)

Re: Why do some searches only display statistics and not Events?

jerryzhao — Thu, 04 Jan 2018 18:59:13 GMT

can you change the drilldown query string from:

    <drilldown>
      <link>
        <![CDATA[
            /app/SplunkAppForFortinet/search?q=`fgt_utm` severity="$click.name2$" earliest=$click.value$ [| stats count | eval latest = $click.value$ %2b 300 | fields latest]
          ]]>
      </link>
    </drilldown>

to following:

    <drilldown>
      <link>
        <![CDATA[
            /app/SplunkAppForFortinet/search?q=| datamodel "ftnt_fos" "utm" search | search log.utm.gseverity="$click.value$"&earliest=$time_token.earliest$&latest=$time_token.latest$
          ]]>
      </link>
    </drilldown>

in this file on your splunk search head:

/opt/splunk/etc/apps/SplunkAppForFortinet/default/data/ui/views/threat_dashboard.xml

Re: Why do some searches only display statistics and not Events?

summitsplunk — Thu, 04 Jan 2018 22:01:31 GMT

Thanks for your input I've modified the drilldown as you suggested however I still cannot view the related events from this query.

Re: Why do some searches only display statistics and not Events?

jerryzhao — Thu, 04 Jan 2018 23:04:35 GMT

but what did it print out?

Re: Why do some searches only display statistics and not Events?

summitsplunk — Thu, 04 Jan 2018 23:42:22 GMT

It appears that it added a "critical column which is nice. I'm hoping you can see the attacked picture below.

https://drive.google.com/file/d/19VPCVdztOH_XNiHV2kXNf8cduj0D5xFA/view?usp=sharing

Re: Why do some searches only display statistics and not Events?

jerryzhao — Tue, 29 Sep 2020 17:29:41 GMT

this is not what the query i gave you should show.
maybe you are editing the wrong line.
Line 24 should be the line to be replaced with:
/app/SplunkAppForFortinet/search?q=| datamodel "ftnt_fos" "utm" search | search log.utm.gseverity="$click.value$"&earliest=$time_token.earliest$&latest=$time_token.latest$

Re: Why do some searches only display statistics and not Events?

summitsplunk — Fri, 05 Jan 2018 00:15:17 GMT

What I see on line 24 https://drive.google.com/file/d/1lX41MEvqqYkvhn2DTAu6ISGluv8ozPfa/view?usp=sharing

The Code I edited
https://drive.google.com/file/d/1hF2-tk7cNq1dYqwvoSe57rJtB93MSTmc/view?usp=sharing