Tag field is not showing in tstats search

[bhsakarchourasi]

Hi All,

Maybe a silly question but when i am running below search it's not returning the tag values as expected.

|tstats summariesonly=false count from datamodel= Malware where sourcetype=mysourcetype by index sourcetype Malware_Attacks.tag 

But when I run below query this shows the result.

index=myindex sourcetype=mysourcetype tag=malware tag=attack

Any solution will be most appreciated how can I get the TAG values using data model query/ tstats query.

Thanks,

Bhaskar

[richgalloway]

Tags are not indexed fields so tstats will not find them.

[bhsakarchourasi · Accepted solution]

Thanks for the reply

I figured it out, the problem resolved by whitelisting tag malware and attacks in ES -> CIM Setup -> Malware data model now tags are showing in result.

Thanks again for taking some time to revert on my question.

Regards,

Bhaskar