topic issue in correlation search in Splunk Search

issue in correlation search

kjain041523 — Thu, 13 Aug 2026 06:32:00 GMT

| tstats summariesonly count dc(IDS_Attacks.dest) as dest from datamodel=Intrusion_Detection.IDS_Attacks where * by IDS_Attacks.src IDS_Attacks.signature _time | drop_dm_object_name("IDS_Attacks") | search NOT signature=Unknown* signature="Vulnerability exploit detection(32796)"

please provide the correct splunk query to display raw events and statistics

Re: issue in correlation search

ITWhisperer — Thu, 13 Aug 2026 07:27:12 GMT

What is wrong with what you already have tried?

Re: issue in correlation search

PickleRick — Thu, 13 Aug 2026 07:33:59 GMT

1. What do you mean by "statistics" here?

2. If you use tstats with datamodel summaries, you don't deal with raw events.

Re: issue in correlation search

gcusello — Thu, 13 Aug 2026 07:43:29 GMT

Hi @kjain041523 ,

if you use a Data Model, you don't have raw data, so you have to divide the output in two panel with two searches (one using DM for statistics and one using indexes for raw data, eventually filtering results from the first panel) or use indexes.

Using indexes in one search, you could try something like this:

(`cim_Intrusion_Detection_indexes`) tag=ids tag=attack | stats count dc(IDS_Attacks.dest) as dest values(_raw) AS _raw by src signature _time | `drop_dm_object_name("IDS_Attacks")` | search NOT signature=Unknown* signature="Vulnerability exploit detection(32796)"

Ciao.

Giuseppe

P.S.: WHERE * has no sense!