https://community.splunk.com/t5/Splunk-Search/Data-model-in-custom-search/m-p/575044#M200380 <P>Hi all,</P><P>I have a doubt regarding the datamodel use.</P><P>In Splunk Foundamentals 2 course, I got what Data Models is and how to use it with Pivot.</P><P>My doubt now is the following: is it possible to use a datamodel and its field in a custom search, for example in the Search and Reporting app? And if yes, how?</P><P>Suppose I have to perform a simple search like this one on network traffic:</P><P><STRONG>index=&lt;some index&gt; sourcetype=&lt;some_sourcetype&gt;| stats count src as source by dest as destination</STRONG></P><P>Suppose now I want to use Network Traffic Data model and its Data set All_Traffic to perform this search, to avoid the use of index and sourcetype; is this possible? And if yes, how to perform this search?</P> Tue, 16 Nov 2021 13:39:39 GMT SIEMStudent 2021-11-16T13:39:39Z https://community.splunk.com/t5/Splunk-Search/Data-model-in-custom-search/m-p/575044#M200380 <P>Hi all,</P><P>I have a doubt regarding the datamodel use.</P><P>In Splunk Foundamentals 2 course, I got what Data Models is and how to use it with Pivot.</P><P>My doubt now is the following: is it possible to use a datamodel and its field in a custom search, for example in the Search and Reporting app? And if yes, how?</P><P>Suppose I have to perform a simple search like this one on network traffic:</P><P><STRONG>index=&lt;some index&gt; sourcetype=&lt;some_sourcetype&gt;| stats count src as source by dest as destination</STRONG></P><P>Suppose now I want to use Network Traffic Data model and its Data set All_Traffic to perform this search, to avoid the use of index and sourcetype; is this possible? And if yes, how to perform this search?</P> Tue, 16 Nov 2021 13:39:39 GMT https://community.splunk.com/t5/Splunk-Search/Data-model-in-custom-search/m-p/575044#M200380 SIEMStudent 2021-11-16T13:39:39Z https://community.splunk.com/t5/Splunk-Search/Data-model-in-custom-search/m-p/575076#M200386 <P>There are a couple of ways to do that (and perhaps others).</P><P>The fastest is to use the <FONT face="courier new,courier">tstats</FONT> command.</P><LI-CODE lang="markup">| tstats count(foo.src) as source from datamodel=foo by foo.dest | rename foo.dest as destination</LI-CODE><P>The other method uses the from command.</P><LI-CODE lang="markup">| from datamodel foo | stats count(src) as source by dest | rename dest as destination</LI-CODE><P>&nbsp;</P> Tue, 16 Nov 2021 15:44:43 GMT https://community.splunk.com/t5/Splunk-Search/Data-model-in-custom-search/m-p/575076#M200386 richgalloway 2021-11-16T15:44:43Z