Extract error message from network_traffic data model

[mchoudhary]

Hi!

I am creating a basic dashboard which shows the total number of firewall blocked for 3 sourcetypes using data model "network_traffic". Query is-

| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where sourcetype IN ("cp_log", "cisco:asa", "pan:traffic") All_Traffic.action="blocked"

Now I am trying to add one more panel which will show what is causing the block activity (error message) for each sourcetype with respect to count, but I am unable to figure out the appropriate field (or query) from the data model which is related to the error message.

Can someone help me understand which field to group by to get the error message.

P.S I am new to splunk

[livehybrid]

Hi @mchoudhary 

Ultimately this depends on what has been extracted and if the data is CIM compliant.

You can see all of the fields for the Network_Traffic data model at https://docs.splunk.com/Documentation/CIM/6.0.4/User/NetworkTraffic

Whilst there isnt a specific "error message" field - I think from memory you might find some use from the "rule" field which combined with the blocked action should give you some insight on the block reason.

Try something like this:

| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where sourcetype IN ("cp_log", "cisco:asa", "pan:traffic") All_Traffic.action="blocked" BY All_Traffic.rule sourcetype

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing