topic Re: TSTATS and searches that run strange in Getting Data In

TSTATS and searches that run strange

domino30 — Tue, 11 Jul 2023 22:04:11 GMT

I think my question is --Is the Search overall returning the SRC filed the way it does because either A there is no data or B filling in from the search and the search needs to be changed.

This is a tstats search from either infosec or enterprise security.

What should I change or do I need to do something different.

Re: TSTATS and searches that run strange

inventsekar — Wed, 12 Jul 2023 00:45:52 GMT

May i rephrase your question like this:

The tstats search runs fine, returns the SRC field, but the SRC results are not what i expected...

because ..

A) there is no data

B) filling in from the search and the search needs to be changed

Can you pls copy paste the search query inside the question.. it will help us copy ur query and run it in our splunk. thanks.

Re: TSTATS and searches that run strange

domino30 — Wed, 12 Jul 2023 15:34:28 GMT

It came from the infosec app under host investigation

Here is the search

| tstats summariesonly=true allow_old_summaries=true max(_time) as _time, values(Authentication.action) as action, values(Authentication.app) as app, count from datamodel=Authentication.Authentication where (Authentication.src="::ffff:10.4.118.10" OR Authenication.dest="::ffff:10.4.118.10") by Authentication.src, Authentication.src_user, Authentication.dest, Authentication.user
| rename "Authentication.*" as "*"
| eval src=if((src=== "unknown"),null(),src), dest=if((dest == "unknown"),null(),dest)
| fields + _time, src, dest, action, app, count, user, src_user, count
| sort - count

Re: TSTATS and searches that run strange

inventsekar — Thu, 13 Jul 2023 00:20:33 GMT

thanks for the Search Query... but still your question "Is the Search overall returning the SRC filed the way it does because either A there is no data or B filling in from the search and the search needs to be changed."

is not clear.. please update us, from the tstats command what kind of results you are looking for(maybe provide us a table format sample output what you are looking for)..then we can reverse engineer the tstats command for your.. thanks.

Re: TSTATS and searches that run strange

domino30 — Thu, 13 Jul 2023 19:15:37 GMT

figured out I was searching for what I got in the example that I got however I got another question

what about these unknowns and also the src is funky but I think its because if it not known it returns that ::fff10.x.x.x. field but im not sure