https://community.splunk.com/t5/Splunk-Enterprise-Security/Network-data-statics-dashboard/m-p/481943#M7772 <P>Certain things are a little unclear.<BR /><BR /> 1) how much data do you want?<BR /> 2) how much data is on the underlying indexes?<BR /> 3) how much data is the data model set to retain?<BR /> 4) have you verified that the data model is fully up to date and there are no skipped searches?</P> Thu, 23 Apr 2020 22:51:18 GMT DalJeanis 2020-04-23T22:51:18Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Network-data-statics-dashboard/m-p/481942#M7771 <P>Hello, </P> <P>I have request to collect all network data based allowed denyed and dropped traffic info from various network feeds.<BR /> Unfortunately my network data model is not set only 15 days worth of data so i have to run manual searches to collect data so any <BR /> help will be much appreciated .<BR /> I have tried with below one but not showing all data and any help will be much appreciated </P> <PRE><CODE>| tstats summariesonly=t allow_old_summaries=f count FROM datamodel=Network_Traffic.All_Traffic WHERE index=* BY sourcetype All_Traffic.action _time span=1h | rename All_Traffic.* AS * | stats count As total_connections count(eval(action=="allowed")) AS allowed count(eval(action=="blocked" OR action=="dropped")) AS blocked BY _time, sourcetype | eval pct_blocked = 100 * blocked / total_connections </CODE></PRE> Wed, 22 Apr 2020 14:16:42 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Network-data-statics-dashboard/m-p/481942#M7771 Splunk_rocks 2020-04-22T14:16:42Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Network-data-statics-dashboard/m-p/481943#M7772 <P>Certain things are a little unclear.<BR /><BR /> 1) how much data do you want?<BR /> 2) how much data is on the underlying indexes?<BR /> 3) how much data is the data model set to retain?<BR /> 4) have you verified that the data model is fully up to date and there are no skipped searches?</P> Thu, 23 Apr 2020 22:51:18 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Network-data-statics-dashboard/m-p/481943#M7772 DalJeanis 2020-04-23T22:51:18Z