Issue on using event types as constraints for Data model

Zanusha443 — Tue, 11 Jun 2024 17:50:38 GMT

Hi,

I am working in a distributed environment with a SHC of 3 search heads and I am mapping vpn logs to fill certain datasets of my custom version of the Authentication data model (not accelerated for the moment).

The datasets I added to the default authentication Data Model are "Failed_Authentication","Successful_Authentication" and "Login_Attempt", as you can see below:

Then, I created an eventtype (with some associated tags) to match specific conditions for an authentication success, as shown below:

sourcetype=XX action=success signature IN ("Agent login","Login","Secondary authentication","Primary authentication") OR (signature="Session" AND action="success")

Then, I used the Eventtype as a constraint for the dataset "Authentication.Successful_Authentication" as shown below:

To test if the constraint is working or not:

I used the pivoting button offered by the GUI and it returns me some results!
I run in the search app the following SPL and it also returns some results:

index=vpn* tag=authentication eventtype=auth_vpn_success

However, if I try to retrieve the same information by using the following SPL (by using tstat), it returns no results:

|tstats summariesonly=f count from datamodel=Authentication where nodename=Authentication.Successful_Authentication

Even by running another SPL(based on tstat) to retrieve the eventtypes of the Authentication Data Model it returns no results:

| tstats count from datamodel=Authentication by eventtype

I tried to troubleshoot the issue with 2 different tests:

Not using the field eventtypes as Dataset constraint.
Creating another eventtype and using a different Data Model (Change).

1) I created a dataset constraint for "Authentication.Failed_Authentication" which is not using either tag or eventtypes, as follow:

action=failure

And both of the aforementioned tstats SPLs are working now!

2) I created another eventtype related to a change log type, as follow:

index=vpn* sourcetype=XX AND "User Accounts modified."

And I added it as a constraint for the dataset "All_Changes.Account_Change" :

And by running the 2 aforementioned tstat SPLs they return me some results!

In conclusion, I suspect there is an issue related to either the tag=authentication (maybe some conflict with other default apps?) or the Authentication Data Model (related to custom datasets I added?).

Do you have any clue of what I could have done wrong ?

Kind Regard,

topic Issue on using event types as constraints for Data model in Knowledge Management

Issue on using event types as constraints for Data model