Splunk Enterprise Security

Splunk App for Enterprise Security: Is it possible to restrict a tstats search to a specific index?

may_aaron
Engager

I would like to restrict the tstats search below to a specific index. The search uses the IDS_Attacks datamodel in ES. Is this possible?

|`tstats` count from datamodel=Intrusion_Detection where * IDS_Attacks.ids_type=network IDS_Attacks.category=* IDS_Attacks.severity=* by _time,IDS_Attacks.severity span=10m | chart useother=`useother` count by IDS_Attacks.severity | `drop_dm_object_name("IDS_Attacks")`| sort -count
0 Karma
1 Solution

mdessus_splunk
Splunk Employee
Splunk Employee

The datamodel, as used in the CIM standard (on which ES is based), does not depends on the indexes. So, unless you modify the underlying searches or add an index field to the datamodel, it is not possible.
You'd better make sure that your data is not tagged to go in the datamodel.

View solution in original post

mdessus_splunk
Splunk Employee
Splunk Employee

The datamodel, as used in the CIM standard (on which ES is based), does not depends on the indexes. So, unless you modify the underlying searches or add an index field to the datamodel, it is not possible.
You'd better make sure that your data is not tagged to go in the datamodel.

First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...