topic How to modify my search to data model search by adding a lookup table? in Splunk Search

How to modify my search to data model search by adding a lookup table?

balu1211 — Wed, 12 Apr 2023 19:52:13 GMT

Hi,

My task involves creating a search in datamodel i.e network_traffic, below is the base search how we could convert it to data model search

| tstats summariesonly=t
values(All_Traffic.src_ip) as src_ip,
dc(All_Traffic.dest_port) as num_dest_port,
values(All_Traffic.dest_port) as dest_port
from datamodel=Network_Traffic by All_Traffic.dest_ip
| where num_dest_port > 100

Thanks..

Re: how to modify my search to data model search by adding a lookup table?

woodcock — Wed, 12 Apr 2023 19:29:45 GMT

| tstats ,values(All_Traffic.dest_port) AS dest_port values(All_Traffic.dest_ip) AS dest_ip dc(All_Traffic.dest_ip) AS num_dest_ip dc(All_Traffic.dest_port) AS num_dest_port
FROM datamodel=Network_Traffic
WHERE index="firewall" AND sourcetype="traffic" AND NOT [| inputlookup addresses.csv | search (comments =*scanner*) | table IP | rename IP AS ALL_Traffic.src_ip | format ]
BY All_Traffic.src_ip
| rename All_Traffic.* AS *
| where num_dest_port > 100