Splunk Enterprise Security

Network data statics dashboard

Splunk_rocks
Path Finder

Hello,

I have request to collect all network data based allowed denyed and dropped traffic info from various network feeds.
Unfortunately my network data model is not set only 15 days worth of data so i have to run manual searches to collect data so any
help will be much appreciated .
I have tried with below one but not showing all data and any help will be much appreciated

| tstats summariesonly=t allow_old_summaries=f count
 FROM datamodel=Network_Traffic.All_Traffic 
 WHERE index=* BY sourcetype All_Traffic.action _time span=1h 
 | rename All_Traffic.* AS * 
 | stats count As total_connections count(eval(action=="allowed")) AS allowed count(eval(action=="blocked" OR action=="dropped")) AS blocked BY _time, sourcetype 
 | eval pct_blocked = 100 * blocked / total_connections
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Certain things are a little unclear.

1) how much data do you want?
2) how much data is on the underlying indexes?
3) how much data is the data model set to retain?
4) have you verified that the data model is fully up to date and there are no skipped searches?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!