stats command with data model and raw data does not works properly

[SIEMStudent]

Hi Splunkers, we have a behavior that we are not able to understand.
The problem is the following: we are performing some search using data model and, when we need to use stats, we would select both fields row data and datamodel one. However, when we try this, we are not able to see the raw fields.

Let me show an example to better explain.

If we try this simple search:

| from datamodel:"Authentication"
| search is_Failed_Authentication=1
| stats count by log_region log_country user

we expect that stats show in outoput the 2 fields we manually added to data, log_region and log_contry, and the one owned by datamodel, which is user.

Unfortunately, when the result appear we can see only user in the returned table; log_region and log_country are empty.

We know the those data are present and populated because, if we try to replicate the search with same time range but using not datamodel, and so using the specific index, sourcetype and source for windows events, the stats return the output with all 3 fields (in this case, user is of course the specific field of Windows events).

Is this normal? Is there a way to use both raw/manually added fields and datamodel ones?

[richgalloway · Accepted solution]

When searching with a datamodel the only fields available are those specified in the DM.

A search that does not use a DM has access to all of the fields in the index(es).

To have it both ways, use two searches and combine them using a subsearch.