Splunk Enterprise Security

Multiple tstats with prestats append=t not working in ES app

vj8210
Explorer

Hi,

I'm querying a datamodel X and I need to append results with same fields names from datamodel xx using. I'm trying with tstats command but it's not working in ES app.

example search:

| tstats append=t `summariesonly` count from datamodel=X where   earliest=-7d  by dest severity
| tstats summariesonly=t  append=t count from datamodel=XX where by dest severity

This will only show results of 1st tstats command and 2nd tstats results are not appended.

Is there any thing wrong here? is there any other way to achieve this?

teresachila
Path Finder

We have out-of-the-box ES correlation searches that use this pattern and the 2nd tstats with append=t is returning zero result.

0 Karma

snoobzilla
Builder

Tstats syntax is a little tricky. I suspect you don't have everything you need there on variable names. Try doing a pivot and then looking in search detail (at normalized search I think )

I think maybe you want to do something more like the following with subsearches...

| tstats `summariesonly` count AS Count1  from datamodel=X by dest severity
| append [ | tstats summariesonly=t count AS Count2 from datamodel=XX by dest severity ]

OR maybe to join same dest severity row...

| tstats `summariesonly` count AS Count1  from datamodel=X by dest severity
| join type=left dest severity [ | tstats summariesonly=t count AS Count2 from datamodel=XX by dest severity ]
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...