topic Re: Data Model Query in Knowledge Management

Data Model Query

sumitkathpal — Tue, 29 Sep 2020 10:36:56 GMT

Dear Experts,

Kindly help to modify Query on Data Model, I have built the query.

Above Query display the Dest IP and Count (Dest IP which matches with Network Traffic and CSV , Result will be displayed) , Also in my Ip.Csv there is field Ip , So i rename to All_Traffic.dest to match the value . Till now everything is fine , Now i am looking for result : Src IP , Dest IP and Count .

Note: I am only comparing Dest IP with CSV no other field.

Re: Data Model Query

jkat54 — Thu, 11 Aug 2016 19:52:09 GMT

What is your new query and what error are you having now?

Re: Data Model Query

sumitkathpal — Fri, 12 Aug 2016 09:03:37 GMT

Thanks, I am not getting the errors , above query give the information about incoming ip address hitting on firewall matches with lookup file. I am getting the out Src IP (Matched IP from Lookup) and Count. Now i want to see Src IP , Count and Dest Ip .

Above Query will give provide below output.
Src IP Src_Count
10.10.10.10 5
But i need output:

Src IP Dest Ip Src_Count
10.10.10.10 x.x.x.x 2

Re: Data Model Query

reed_kelly — Fri, 12 Aug 2016 13:44:59 GMT

It should be simple:

| tstats summariesonly=t count from datamodel=Network_Traffic where * by All_Traffic.dest All_Traffic.src | search [| inputlookup Ip.csv | rename Ip as All_Traffic.dest | fields All_Traffic.dest ] | sort - count