Data model in custom search

[SIEMStudent]

Hi all,

I have a doubt regarding the datamodel use.

In Splunk Foundamentals 2 course, I got what Data Models is and how to use it with Pivot.

My doubt now is the following: is it possible to use a datamodel and its field in a custom search, for example in the Search and Reporting app? And if yes, how?

Suppose I have to perform a simple search like this one on network traffic:

index=<some index> sourcetype=<some_sourcetype>| stats count src as source by dest as destination

Suppose now I want to use Network Traffic Data model and its Data set All_Traffic to perform this search, to avoid the use of index and sourcetype; is this possible? And if yes, how to perform this search?

[richgalloway · Accepted solution]

There are a couple of ways to do that (and perhaps others).

The fastest is to use the tstats command.

| tstats count(foo.src) as source from datamodel=foo by foo.dest
| rename foo.dest as destination

The other method uses the from command.

| from datamodel foo | stats count(src) as source by dest 
| rename dest as destination