Show a count of all failures from VPN traffic

[hl]

Query: 

| tstats count from datamodel=Network_Sessions.All_Sessions where nodename=All_Sessions.VPN action=failure vpn.signature="WebVPN" by _time span=1h

I'm not understanding something with this datamodel  but my output is always 0 but when I look at in pivot table I can see data from it. 

[PickleRick]

Before you jump into tstats, try simple

| from datamodel:Network_Sessions.VPN
| search action=failure signature=WebVPN

and check if you get any results. If you do, it means there's something wrong with your syntax. (I spot at least one typo - "vpn" as dataset name must be uppercase)

[livehybrid]

Hi @hl 

If you're getting 0 results from that query, but you are getting results in the pivot then it sounds like one of the fields you are using for the filter is not quite right. 

I think the correct query should be:

| tstats count from datamodel=Network_Sessions.All_Sessions where nodename=All_Sessions.VPN All_Sessions.action=failure All_Sessions.signature="WebVPN" by _time span=1h

The action and signature belong to "All_Sessions" 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[hl]

Awesome , but shows 0 results. 

[PrewinThomas]

@hl 

Can you confirm that data model acceleration is enabled, and that the fields you want to search are indexed fields (available in the acceleration summary)? tstats searches work on accelerated data models and can only access fields that are included as indexed/accelerated fields.

As a quick test, run the following to see if your model is returning results.

| tstats count from datamodel=Network_Sessions.All_Sessions by _time span=1h

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[hl]

Thanks for the reply , yes I do get counts by time, but how can I can just VPN data that has a signature="WebVPN" and action="failure" ?