topic Re: How to list datamodel name in a Table in Splunk Search

How to list datamodel name in a Table

DEAD_BEEF — Sat, 15 Sep 2018 19:24:14 GMT

I am trying to list certain datamodels in a table along with their log count but I can't seem to find how to list the datamodel name itself in the table. I tried displayName and datamodelName. The query lists everything I want except for the datamodel so it's difficult to tell which data belongs to which datamodel.

| tstats summariesonly=t min(_time) as min, max(_time) as max count from datamodel=Web 
| append 
    [| tstats summariesonly=t min(_time) as min, max(_time) as max count from datamodel=Malware] 
| append 
    [| tstats summariesonly=t min(_time) as min, max(_time) as max count from datamodel=Intrusion_Detection ] 
| eval "Start time"=strftime(min, "%c") 
| eval "End time"=strftime(max, "%c") 
| eval "Event count" = count 
| fields "Start time" "End time" "Event count"

FINAL SOLUTION

| tstats summariesonly=t min(_time) as min, max(_time) as max count from datamodel=Web 
| appendcols 
    [| datamodel Web 
    | spath displayName 
    | table displayName] 
| eval datamodel_name = Web 
| append 
    [| tstats summariesonly=t min(_time) as min, max(_time) as max count from datamodel=Malware 
    | appendcols 
        [| datamodel Malware 
        | spath displayName 
        | table displayName] 
    | eval datamodel_name = Malware] 
| append 
    [| tstats summariesonly=t min(_time) as min, max(_time) as max count from datamodel=Intrusion_Detection 
    | appendcols 
        [| datamodel Intrusion_Detection 
        | spath displayName 
        | table displayName] 
    | eval datamodel_name = Intrusion_Detection] 
| eval "Start time"=strftime(min, "%c") 
| eval "End time"=strftime(max, "%c") 
| eval "Event count" = count 
| fields "Start time" "End time" "Event count" displayName

Re: How to list datamodel name in a Table

Ravan — Tue, 18 Sep 2018 04:45:11 GMT

Can you try below one

 tstats summariesonly=t min(_time) as min, max(_time) as max count from datamodel=Web |eval datamodel=Web 
 | append 
     [| tstats summariesonly=t min(_time) as min, max(_time) as max count from datamodel=Malwareeval|eval datamodel=Malwareeval] 
 | append 
     [| tstats summariesonly=t min(_time) as min, max(_time) as max count from datamodel=Intrusion_Detection| eval datamodel= Intrusion_Detection] 
 | eval "Start time"=strftime(min, "%c") 
 | eval "End time"=strftime(max, "%c") 
 | eval "Event count" = count 
 | fields "Start time" "End time" "Event count" datamodel

Re: How to list datamodel name in a Table

pramit46 — Tue, 29 Sep 2020 21:19:35 GMT

You can try adding the following against each entry:

| appendcols [| datamodel <>|spath displayName | table displayName]

for example:

Re: How to list datamodel name in a Table

DEAD_BEEF — Thu, 27 Sep 2018 15:46:04 GMT

@Ravan I tried your solution, but it returned the same thing I have now, no datamodel name listed in the table.

Re: How to list datamodel name in a Table

DEAD_BEEF — Thu, 27 Sep 2018 15:49:04 GMT

This worked! I will add the working query to the initial question. Thank you @pramit46

Re: How to list datamodel name in a Table

pramit46 — Mon, 01 Oct 2018 09:57:52 GMT

Good to know that!!!.. Happy Splunking 🙂