Splunk Search

Convert normal search to tstats?

Abdullah
Explorer

Dears,

 

We need your support to convert below search to tstats search.

(index=os_windows OR index=workstation*) tag=authentication user!=*$ action=success EventCode=4624 Logon_Type=10 OR Logon_Type=2 user=admin OR user=administrator OR user=Paradmin OR
user=symadmin | table _time index user Source_Network_Address Workstation_Name action Logon_Type | dedup user Workstation_Name

 

Please your support.

 

Best Regards,

 

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, you can modify the data model to include other fields, but I advise against it.  Once you modify a data model you own it.  Any changes published by Splunk will not be available because your local change will override that delivered with the app.  It's better to aliases and/or tags to have the desired field appear in the existing model.

Having the field in an index is only part of the problem.  The non-tstats query does not compute any stats so there is no equivalent in tstats.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What have you tried so far?

The current query has no stats command so there is no equivalent tstats query.  Furthermore, the query appears to use fields that typically are not indexed (like EventCode), which makes tstats queries impossible.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Abdullah
Explorer

Hi Richgalloway,

Thank you for your reply, but I think you can create new regular expression and create new field for the data model by editing the data model, then we can use this field.

Regads,

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, you can modify the data model to include other fields, but I advise against it.  Once you modify a data model you own it.  Any changes published by Splunk will not be available because your local change will override that delivered with the app.  It's better to aliases and/or tags to have the desired field appear in the existing model.

Having the field in an index is only part of the problem.  The non-tstats query does not compute any stats so there is no equivalent in tstats.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...