How can I fix my query for a malware dashboard, which is throwing me this error: "Error in 'TsidxStats': WHERE clause is not an exact query"?

[kokanne]

I'm trying to fix my query for my malware dashboard, but it doesn't seem to work in any way possible, maybe I'm just not experienced enough to fix it. The query is the following:

| `tstats` count from datamodel=Malware.Malware_Attacks where * $action$ $bunit$ $category$ by _time,Malware_Attacks.action span=10m | timechart minspan=10m useother=true count by Malware_Attacks.action | `drop_dm_object_name("Malware_Attacks")`

The error:
Error in 'TsidxStats': WHERE clause is not an exact query

If anyone could tell me what I'm doing wrong, that would be great. Sorry for posting such a stupid question.

[kokanne]

So look, I put this in my dashboard

| tstats count from datamodel=Malware.Malware_Attacks where * $action$ $bunit_form$ $category_form$ by _time,Malware_Attacks.action span=10m 
     | timechart minspan=10m useother=true count by Malware_Attacks.action 
     | `drop_dm_object_name("Malware_Attacks")`

and this works fine so ,I think that's all I need right

[kokanne]

you did not post an answer yet can you do that so ican accept it thank you

[493669]

Glad to help:) Please accept the answer and upvote the comments which helped you..

[kokanne]

thank you!

[493669]

yes 🙂 that's it.

[493669]

try this:

| tstats count from datamodel=Malware.Malware_Attacks where * action bunit category by _time,Malware_Attacks.action span=10m 
 | timechart minspan=10m useother=true count by Malware_Attacks.action 
 | `drop_dm_object_name("Malware_Attacks")`

[kokanne]

Is executing the search, but does not return any events

[493669]

also I am assuming sign ` around tstats is a typo

[kokanne]

I don't make the query, so I have no idea, it is from enterprise security dashboard

[493669]

so is their any sign around |tstatscommand?