https://community.splunk.com/t5/Splunk-Search/How-do-I-search-the-network-data-model-to-track-certain-ports/m-p/251047#M74995 <P>Hi Mitchell,</P> <P>A good approach for this is to use the pivot interface, which you can access from settings -&gt; data models -&gt; pivot. In this interface, you can specify the filter or search fields you want, to display the output you are looking for. From there, there is an 'open in search' button that would show you the search string that was used to generate the output. This search string will be based on the 'pivot' command. It will look something like:</P> <PRE><CODE>| pivot Network_Traffic All_Traffic count(All_Traffic) AS "Count of All Traffic" SPLITROW action AS action FILTER dest_port = 22 SORT 100 action ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1 </CODE></PRE> <P>Another option is to look at the 'datamodel' search command:</P> <PRE><CODE>| datamodel [] [&lt;object&gt;] [] </CODE></PRE> <P>This is documented here: <A href="http://docs.splunk.com/Documentation/Splunk/6.1.9/SearchReference/Datamodel">http://docs.splunk.com/Documentation/Splunk/6.1.9/SearchReference/Datamodel</A></P> <P>HTH.</P> Fri, 29 Jan 2016 09:37:39 GMT sobrien 2016-01-29T09:37:39Z https://community.splunk.com/t5/Splunk-Search/How-do-I-search-the-network-data-model-to-track-certain-ports/m-p/251046#M74994 <P>I'm very new to searching data models in Splunk and I want to search within my network data model to monitor certain ports. I know I can use the All_traffic.dest_port, but I can't figure out how to make it work. I want dashboards to track failed and successful logins on devices by tracking these ports. So, I need to track ssh logins on port 22 and rdp logins on 3389. Then I want to create a notable event from this search which I know how to create. I just need help using the data model since I'm new to data models. Thanks.</P> Tue, 29 Sep 2020 08:34:20 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-search-the-network-data-model-to-track-certain-ports/m-p/251046#M74994 Mitchellsch 2020-09-29T08:34:20Z https://community.splunk.com/t5/Splunk-Search/How-do-I-search-the-network-data-model-to-track-certain-ports/m-p/251047#M74995 <P>Hi Mitchell,</P> <P>A good approach for this is to use the pivot interface, which you can access from settings -&gt; data models -&gt; pivot. In this interface, you can specify the filter or search fields you want, to display the output you are looking for. From there, there is an 'open in search' button that would show you the search string that was used to generate the output. This search string will be based on the 'pivot' command. It will look something like:</P> <PRE><CODE>| pivot Network_Traffic All_Traffic count(All_Traffic) AS "Count of All Traffic" SPLITROW action AS action FILTER dest_port = 22 SORT 100 action ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1 </CODE></PRE> <P>Another option is to look at the 'datamodel' search command:</P> <PRE><CODE>| datamodel [] [&lt;object&gt;] [] </CODE></PRE> <P>This is documented here: <A href="http://docs.splunk.com/Documentation/Splunk/6.1.9/SearchReference/Datamodel">http://docs.splunk.com/Documentation/Splunk/6.1.9/SearchReference/Datamodel</A></P> <P>HTH.</P> Fri, 29 Jan 2016 09:37:39 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-search-the-network-data-model-to-track-certain-ports/m-p/251047#M74995 sobrien 2016-01-29T09:37:39Z