topic Re: How to use datamodel field values in tstats to filter resultant data? in Getting Data In

How to use datamodel field values in tstats to filter resultant data?

DEAD_BEEF — Sat, 01 Sep 2018 02:33:21 GMT

I'm trying to search my Intrusion Detection datamodel when the src_ip is a specific CIDR to limit the results but can't seem to get the search right. Is this possible?

| tstats count from datamodel=Intrusion_Detection where (nodename IDS_Attacks.src="1.2.3.4/30" OR IDS_Attacks.dest="5.6.7.8/30")
| `drop_dm_object_name("Intrusion_Detection")`
| fields src, dest, dest_port

WORKING QUERY

| tstats count from datamodel=Intrusion_Detection where (nodename = IDS_Attacks (IDS_Attacks.src="1.2.3.4/30" OR IDS_Attacks.dest="5.6.7.8/30")) groupby IDS_Attacks.src, IDS_Attacks.dest, IDS_Attacks.SrcPort, IDS_Attacks.dest_port 
| `drop_dm_object_name("IDS_Attacks")`

Re: How to use datamodel field values in tstats to filter resultant data?

renjith_nair — Sat, 01 Sep 2018 02:49:50 GMT

It's should be possible to filter using where. Are you getting result for

| tstats count from datamodel=Intrusion_Detection where (IDS_Attacks.src="1.2.3.4/30" OR IDS_Attacks.dest="5.6.7.8/30")

EDIT : Working search from @DEAD_BEEF,

 | tstats count from datamodel=Intrusion_Detection where (nodename = IDS_Attacks (IDS_Attacks.src="1.2.3.4/30" OR IDS_Attacks.dest="5.6.7.8/30")) groupby IDS_Attacks.src, IDS_Attacks.dest, IDS_Attacks.SrcPort, IDS_Attacks.dest_port 
 | `drop_dm_object_name("IDS_Attacks")`

Re: How to use datamodel field values in tstats to filter resultant data?

DEAD_BEEF — Sat, 01 Sep 2018 03:33:16 GMT

That worked, thanks! Added the working query in the original question for future readers. Re-post it as response so I can accept it please.