topic Tag field is not showing in tstats search in All Apps and Add-ons

Tag field is not showing in tstats search

bhsakarchourasi — Thu, 12 Nov 2020 13:45:35 GMT

Hi All,

Maybe a silly question but when i am running below search it's not returning the tag values as expected.

|tstats summariesonly=false count from datamodel= Malware where sourcetype=mysourcetype by index sourcetype Malware_Attacks.tag

But when I run below query this shows the result.

index=myindex sourcetype=mysourcetype tag=malware tag=attack

Any solution will be most appreciated how can I get the TAG values using data model query/ tstats query.

Thanks,

Bhaskar

Re: Tag field is not showing in tstats search

richgalloway — Thu, 12 Nov 2020 13:47:56 GMT

Tags are not indexed fields so tstats will not find them.

Re: Tag field is not showing in tstats search

bhsakarchourasi — Thu, 12 Nov 2020 13:55:42 GMT

Thanks for the reply

I figured it out, the problem resolved by whitelisting tag malware and attacks in ES -> CIM Setup -> Malware data model now tags are showing in result.

Thanks again for taking some time to revert on my question.

Regards,

Bhaskar