topic Re: How to write a search leveraging tstats, a data model, and timechart? in Reporting

How to write a search leveraging tstats, a data model, and timechart?

jwalzerpitt — Tue, 01 Nov 2022 13:52:17 GMT

I am looking to convert this regular search:

index=foo action=blocked `macro` src_zone=foo | timechart count span=1d

over to a search that leverage tstats and the Network Traffic datamodel that shows the count of blocked traffic per day for the past 7 days due to the large volume of network events

| tstats count AS "Count of Blocked Traffic" from datamodel=Network_Traffic where (nodename = All_Traffic.Traffic_By_Action.Blocked_Traffic) All_Traffic.src_zone=foo groupby _time, All_Traffic.src_zone prestats=true

How can I get this search to use timechart?

Thx

Re: How to write a search leveraging tstats, a data model, and timechart?

richgalloway — Tue, 01 Nov 2022 14:05:06 GMT

Adding the timechart command should do it.

Re: How to write a search leveraging tstats, a data model, and timechart?

jwalzerpitt — Tue, 01 Nov 2022 14:15:36 GMT

TYVM Rich!

If I needed to add a macro in the search, where would I place that?

Thx again

Re: How to write a search leveraging tstats, a data model, and timechart?

richgalloway — Tue, 01 Nov 2022 14:43:22 GMT

It depends on what the macro does. Start by putting it in the where clause of the tstats command.

Re: How to write a search leveraging tstats, a data model, and timechart?

jwalzerpitt — Thu, 03 Nov 2022 16:52:58 GMT

@richgalloway

If I wanted to change this search up so it's looking at total traffic events with an overlay of the avg number of blocks, how would I write that query?

I have the following but not getting any results:

| tstats count AS "Total Traffic" from datamodel=Network_Traffic where (nodename = All_Traffic) All_Traffic.src_zone=INTERNET-O groupby _time span=1d, All_Traffic.src_zone, All_Traffic.Traffic_By_Action.Blocked_Traffic prestats=true | `drop_dm_object_name("All_Traffic")` | timechart span=1d count | stats avg(count) by Traffic_By_Action.Blocked_Traffic

Is the issue that I'm pulling from two different objects in the Network datamodel - All_Traffic and Blocked_Traffic and not referencing the Blocked_Traffic model correctly?

Re: How to write a search leveraging tstats, a data model, and timechart?

jwalzerpitt — Thu, 03 Nov 2022 17:55:03 GMT

Mucking around some more and getting closer as I now have this:

| tstats count AS "Total Traffic" from datamodel=Network_Traffic where (nodename = All_Traffic ) OR (nodename = Blocked_Traffic) All_Traffic.src_zone=INTERNET-O groupby _time span=1d, All_Traffic.src_zone, All_Traffic.action, All_Traffic.Traffic_By_Action.Blocked_Traffic prestats=true | `drop_dm_object_name("All_Traffic")` | timechart span=1d count by action | eval "Block Avg" = round('blocked'*100/('allowed'+'blocked'),2)

But two issues:

Timechart now shows bars by action and 'd like to see just the total count of network sessions
The average is basically flatlined as it's at roughly 40% whereas my totals by action are roughly 1.5B