Splunk Enterprise Security

Splunk App for Enterprise Security: Is it possible to restrict a tstats search to a specific index?

may_aaron
Engager

I would like to restrict the tstats search below to a specific index. The search uses the IDS_Attacks datamodel in ES. Is this possible?

|`tstats` count from datamodel=Intrusion_Detection where * IDS_Attacks.ids_type=network IDS_Attacks.category=* IDS_Attacks.severity=* by _time,IDS_Attacks.severity span=10m | chart useother=`useother` count by IDS_Attacks.severity | `drop_dm_object_name("IDS_Attacks")`| sort -count
0 Karma
1 Solution

mdessus_splunk
Splunk Employee
Splunk Employee

The datamodel, as used in the CIM standard (on which ES is based), does not depends on the indexes. So, unless you modify the underlying searches or add an index field to the datamodel, it is not possible.
You'd better make sure that your data is not tagged to go in the datamodel.

View solution in original post

mdessus_splunk
Splunk Employee
Splunk Employee

The datamodel, as used in the CIM standard (on which ES is based), does not depends on the indexes. So, unless you modify the underlying searches or add an index field to the datamodel, it is not possible.
You'd better make sure that your data is not tagged to go in the datamodel.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...