topic Convert normal search to tstats? in Splunk Search

Convert normal search to tstats?

Abdullah — Tue, 15 Nov 2022 13:54:14 GMT

Dears,

We need your support to convert below search to tstats search.

(index=os_windows OR index=workstation*) tag=authentication user!=*$ action=success EventCode=4624 Logon_Type=10 OR Logon_Type=2 user=admin OR user=administrator OR user=Paradmin OR user=symadmin | table _time index user Source_Network_Address Workstation_Name action Logon_Type | dedup user Workstation_Name

Please your support.

Best Regards,

Re: Convert normal search to tstats?

richgalloway — Tue, 15 Nov 2022 14:00:13 GMT

What have you tried so far?

The current query has no stats command so there is no equivalent tstats query. Furthermore, the query appears to use fields that typically are not indexed (like EventCode), which makes tstats queries impossible.

Re: Convert normal search to tstats?

Abdullah — Wed, 16 Nov 2022 11:34:32 GMT

Hi Richgalloway,

Thank you for your reply, but I think you can create new regular expression and create new field for the data model by editing the data model, then we can use this field.

Regads,

Re: Convert normal search to tstats?

richgalloway — Wed, 16 Nov 2022 14:35:15 GMT

Yes, you can modify the data model to include other fields, but I advise against it. Once you modify a data model you own it. Any changes published by Splunk will not be available because your local change will override that delivered with the app. It's better to aliases and/or tags to have the desired field appear in the existing model.

Having the field in an index is only part of the problem. The non-tstats query does not compute any stats so there is no equivalent in tstats.