topic Re: Need changes to the datamodel search in Splunk Enterprise Security

Need changes to the datamodel search

AL3Z — Wed, 25 Oct 2023 10:54:55 GMT

Hi,

I aimed to merge the "dropped" and "blocked" values under the "IDS_Attacks.action" field in the output of the datamodel search and include their respective counts within the newly created "blocked" field.

so that I can add it to the dashboard.
output:

IDS_Attacks.action count

allowed	130016
blocked	595
dropped	1123

Re: Need changes to the datamodel search

richgalloway — Wed, 25 Oct 2023 12:57:30 GMT

I strongly advise against modifying datamodels that are not your own. If you change a DM, your changes will override any future versions of the DM that may be released.

Instead, have your dashboard combine the values by changing "dropped" to "blocked".

| eval IDS_Attacks.action=if(IDS_Attacks.action="dropped","blocked",IDS_Attacks.action)

Re: Need changes to the datamodel search

AL3Z — Wed, 25 Oct 2023 17:30:36 GMT

Hi,

Why I'm not seeing the field IDS_Attacks.sourcetype field in the datamodel ?

Re: Need changes to the datamodel search

richgalloway — Wed, 25 Oct 2023 18:52:22 GMT

I don't know why you're not seeing the sourcetype field. Every event should have that field.

Re: Need changes to the datamodel search

AL3Z — Wed, 25 Oct 2023 21:19:25 GMT

May be the taging is not done it in a right way. Where we need to check further?