need spl into datamodel search

[AL3Z]

Hi,
Need below search into a web datmodel search 
index=es_web action=blocked host= * sourcetype= *
| stats count by category
| sort 5 -count

thanks

[fredclown]

I think this should work. You shouldn't need to include the host=* or sourcetype=* as every event has a host and sourcetype.

|tstats count from datamodel={your data model} where index="es_web" AND {your data model}.action="blocked" by {your data model}.category
|sort 5 -count