https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Troubleshooting-Web-Data-Model/m-p/420552#M5188 <P>We have ES up and running and I'm starting to review the various Security Domains and relevant dashboards/reports.</P> <P>For Security Domain -- Network -- Web Center there is a widget of 'Events Over Time By Status' that when I send to a search returns values other than HTTP status codes (200, 401, etc). </P> <P>I do a pivot of the web data model and select 'status' and 'sourcetype' and I see the pan:threat sourcetype from our Palo Alto logs included with values that do not correspond to HTTP status codes. </P> <P>Where would, or how would I go about excluding the pan:threat sourcetype from either the search, or from 'status' altogether?</P> <P>The search is as follows:</P> <PRE><CODE>| `tstats` count from datamodel=Web.Web where * by _time,Web.status span=10m | timechart minspan=10m useother=`useother` count by Web.status | `drop_dm_object_name("Web")` </CODE></PRE> Fri, 19 Apr 2019 14:48:38 GMT jwalzerpitt 2019-04-19T14:48:38Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Troubleshooting-Web-Data-Model/m-p/420552#M5188 <P>We have ES up and running and I'm starting to review the various Security Domains and relevant dashboards/reports.</P> <P>For Security Domain -- Network -- Web Center there is a widget of 'Events Over Time By Status' that when I send to a search returns values other than HTTP status codes (200, 401, etc). </P> <P>I do a pivot of the web data model and select 'status' and 'sourcetype' and I see the pan:threat sourcetype from our Palo Alto logs included with values that do not correspond to HTTP status codes. </P> <P>Where would, or how would I go about excluding the pan:threat sourcetype from either the search, or from 'status' altogether?</P> <P>The search is as follows:</P> <PRE><CODE>| `tstats` count from datamodel=Web.Web where * by _time,Web.status span=10m | timechart minspan=10m useother=`useother` count by Web.status | `drop_dm_object_name("Web")` </CODE></PRE> Fri, 19 Apr 2019 14:48:38 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Troubleshooting-Web-Data-Model/m-p/420552#M5188 jwalzerpitt 2019-04-19T14:48:38Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Troubleshooting-Web-Data-Model/m-p/420553#M5189 <P>I'm tempted to modify the CS to exclude the PAN events.</P> <PRE><CODE>| `tstats` count from datamodel=Web.Web where NOT sourcetype=pan:threat by _time,Web.status span=10m | timechart minspan=10m useother=`useother` count by Web.status | `drop_dm_object_name("Web")` </CODE></PRE> Fri, 19 Apr 2019 19:47:21 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Troubleshooting-Web-Data-Model/m-p/420553#M5189 richgalloway 2019-04-19T19:47:21Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Troubleshooting-Web-Data-Model/m-p/420554#M5190 <P>Thx Rich - worked perfectly</P> Wed, 01 May 2019 14:46:35 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-Troubleshooting-Web-Data-Model/m-p/420554#M5190 jwalzerpitt 2019-05-01T14:46:35Z