TSTATS and searches that run strange

[domino30]

tstats and search.PNG

 I think my question is --Is the Search overall returning the SRC filed the way it does because  either A there is no data or B filling in from the search and the search needs to be changed.

This is a tstats search from either infosec or enterprise security.

What should I change or do I need to do  something different.

[inventsekar]

May i rephrase your question like this:

The tstats search runs fine, returns the SRC field, but the SRC results are not what i expected... 

because ..

A) there is no data

B) filling in from the search and the search needs to be changed

Can you pls copy paste the search query inside the question.. it will help us copy ur query and run it in our splunk. thanks. 

[domino30]

It came from the infosec app under host investigation

Here is the search

| tstats summariesonly=true allow_old_summaries=true max(_time) as _time, values(Authentication.action) as action, values(Authentication.app) as app, count from datamodel=Authentication.Authentication where (Authentication.src="::ffff:10.4.118.10" OR Authenication.dest="::ffff:10.4.118.10") by Authentication.src, Authentication.src_user, Authentication.dest, Authentication.user
| rename "Authentication.*" as "*"
| eval src=if((src=== "unknown"),null(),src), dest=if((dest == "unknown"),null(),dest)
| fields + _time, src, dest, action, app, count, user, src_user, count
| sort - count

[inventsekar]

thanks for the Search Query... but still your question "Is the Search overall returning the SRC filed the way it does because  either A there is no data or B filling in from the search and the search needs to be changed."

is not clear.. please update us, from the tstats command what kind of results you are looking for(maybe provide us a table format sample output what you are looking for)..then we can reverse engineer the tstats command for your.. thanks.

[domino30]

figured out I was searching for what I got in the example that I got however I got  another question

what about this.PNG

 what about these unknowns and also the src is funky but I think its because if it not known it returns that ::fff10.x.x.x. field but im not sure