How to use datamodel field values in tstats to filter resultant data?

[DEAD_BEEF]

I'm trying to search my Intrusion Detection datamodel when the src_ip is a specific CIDR to limit the results but can't seem to get the search right. Is this possible?

| tstats count from datamodel=Intrusion_Detection where (nodename IDS_Attacks.src="1.2.3.4/30" OR IDS_Attacks.dest="5.6.7.8/30")
| `drop_dm_object_name("Intrusion_Detection")`
| fields src, dest, dest_port

WORKING QUERY

| tstats count from datamodel=Intrusion_Detection where (nodename = IDS_Attacks (IDS_Attacks.src="1.2.3.4/30" OR IDS_Attacks.dest="5.6.7.8/30")) groupby IDS_Attacks.src, IDS_Attacks.dest, IDS_Attacks.SrcPort, IDS_Attacks.dest_port 
| `drop_dm_object_name("IDS_Attacks")`

[renjith_nair · Accepted solution]

It's should be possible to filter using where. Are you getting result for

| tstats count from datamodel=Intrusion_Detection where (IDS_Attacks.src="1.2.3.4/30" OR IDS_Attacks.dest="5.6.7.8/30")

EDIT : Working search from @DEAD_BEEF,

 | tstats count from datamodel=Intrusion_Detection where (nodename = IDS_Attacks (IDS_Attacks.src="1.2.3.4/30" OR IDS_Attacks.dest="5.6.7.8/30")) groupby IDS_Attacks.src, IDS_Attacks.dest, IDS_Attacks.SrcPort, IDS_Attacks.dest_port 
 | `drop_dm_object_name("IDS_Attacks")`

[DEAD_BEEF]

That worked, thanks! Added the working query in the original question for future readers. Re-post it as response so I can accept it please.