Extract error message from network_traffic data model

mchoudhary — Tue, 06 May 2025 19:45:20 GMT

Hi!

I am creating a basic dashboard which shows the total number of firewall blocked for 3 sourcetypes using data model "network_traffic". Query is-

| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where sourcetype IN ("cp_log", "cisco:asa", "pan:traffic") All_Traffic.action="blocked"

Now I am trying to add one more panel which will show what is causing the block activity (error message) for each sourcetype with respect to count, but I am unable to figure out the appropriate field (or query) from the data model which is related to the error message.

Can someone help me understand which field to group by to get the error message.

P.S I am new to splunk

Re: Extract error message from network_traffic data model

livehybrid — Tue, 06 May 2025 21:46:54 GMT

Hi @mchoudhary

Ultimately this depends on what has been extracted and if the data is CIM compliant.

You can see all of the fields for the Network_Traffic data model at https://docs.splunk.com/Documentation/CIM/6.0.4/User/NetworkTraffic

Whilst there isnt a specific "error message" field - I think from memory you might find some use from the "rule" field which combined with the blocked action should give you some insight on the block reason.

Try something like this:

| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where sourcetype IN ("cp_log", "cisco:asa", "pan:traffic") All_Traffic.action="blocked" BY All_Traffic.rule sourcetype

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

topic Extract error message from network_traffic data model in Splunk Cloud Platform

Extract error message from network_traffic data model

Re: Extract error message from network_traffic data model