Convert normal search to tstats?

[Abdullah]

Dears,

We need your support to convert below search to tstats search.

(index=os_windows OR index=workstation*) tag=authentication user!=*$ action=success EventCode=4624 Logon_Type=10 OR Logon_Type=2 user=admin OR user=administrator OR user=Paradmin OR
user=symadmin | table _time index user Source_Network_Address Workstation_Name action Logon_Type | dedup user Workstation_Name

Please your support.

Best Regards,

[richgalloway]

What have you tried so far?

The current query has no stats command so there is no equivalent tstats query.  Furthermore, the query appears to use fields that typically are not indexed (like EventCode), which makes tstats queries impossible.

[Abdullah]

Hi Richgalloway,

Thank you for your reply, but I think you can create new regular expression and create new field for the data model by editing the data model, then we can use this field.

Regads,

[richgalloway · Accepted solution]

Yes, you can modify the data model to include other fields, but I advise against it.  Once you modify a data model you own it.  Any changes published by Splunk will not be available because your local change will override that delivered with the app.  It's better to aliases and/or tags to have the desired field appear in the existing model.

Having the field in an index is only part of the problem.  The non-tstats query does not compute any stats so there is no equivalent in tstats.