Splunk App for Enterprise Security: Is it possible to limit my search of the Intrusion Detection datamodel to only IPS events and exclude firewall events?

[may_aaron]

I want to create a single value chart to illustrate total intrusion detection events, however, I want to limit the results to our IPS threat events and exclude our firewall threat events. Is this possible to do this? Also, are there any good resources for understanding the datamodel search syntax? I've reviewed the Splunk documentation, but I didn't find it very helpful.

[sowings]

Certainly; you could modify the data model itself to include a base-level filter string (like "sourcetype=my_ips_sourcetype") in the base event filter. Not recommended, but possible. Note that in future versions of ES, you'll be able to easily provide (with UI workflow) a list of indexes to consider. In this way, you could constrain the model to only search the index where the IDS / IPS data live, and ignore the firewall index.