- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

We have ES up and running and I'm starting to review the various Security Domains and relevant dashboards/reports.
For Security Domain -- Network -- Web Center there is a widget of 'Events Over Time By Status' that when I send to a search returns values other than HTTP status codes (200, 401, etc).
I do a pivot of the web data model and select 'status' and 'sourcetype' and I see the pan:threat sourcetype from our Palo Alto logs included with values that do not correspond to HTTP status codes.
Where would, or how would I go about excluding the pan:threat sourcetype from either the search, or from 'status' altogether?
The search is as follows:
| `tstats` count from datamodel=Web.Web where * by _time,Web.status span=10m
| timechart minspan=10m useother=`useother` count by Web.status
| `drop_dm_object_name("Web")`
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


I'm tempted to modify the CS to exclude the PAN events.
| `tstats` count from datamodel=Web.Web where NOT sourcetype=pan:threat by _time,Web.status span=10m
| timechart minspan=10m useother=`useother` count by Web.status
| `drop_dm_object_name("Web")`
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


I'm tempted to modify the CS to exclude the PAN events.
| `tstats` count from datamodel=Web.Web where NOT sourcetype=pan:threat by _time,Web.status span=10m
| timechart minspan=10m useother=`useother` count by Web.status
| `drop_dm_object_name("Web")`
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Thx Rich - worked perfectly
