Need changes to the datamodel search

[AL3Z]

Hi,

I aimed to merge the "dropped" and "blocked" values under the "IDS_Attacks.action" field in the output of the datamodel search and include their respective counts within the newly created "blocked" field.

so that I can add it to the dashboard.
output:

IDS_Attacks.action count

allowed	130016
blocked	595
dropped	1123

[richgalloway]

I strongly advise against modifying datamodels that are not your own.  If you change a DM, your changes will override any future versions of the DM that may be released.

Instead, have your dashboard combine the values by changing "dropped" to "blocked".

| eval IDS_Attacks.action=if(IDS_Attacks.action="dropped","blocked",IDS_Attacks.action)

[AL3Z]

Hi,

Why I'm not seeing the field IDS_Attacks.sourcetype field in the datamodel  ? 

[richgalloway]

I don't know why you're not seeing the sourcetype field.  Every event should have that field.

[AL3Z]

May be the taging is not done it in a right way. Where we need to check further?