How do I search the network data model to track certain ports?

[Mitchellsch]

I'm very new to searching data models in Splunk and I want to search within my network data model to monitor certain ports. I know I can use the All_traffic.dest_port, but I can't figure out how to make it work. I want dashboards to track failed and successful logins on devices by tracking these ports. So, I need to track ssh logins on port 22 and rdp logins on 3389. Then I want to create a notable event from this search which I know how to create. I just need help using the data model since I'm new to data models. Thanks.

[sobrien]

Hi Mitchell,

A good approach for this is to use the pivot interface, which you can access from settings -> data models -> pivot. In this interface, you can specify the filter or search fields you want, to display the output you are looking for. From there, there is an 'open in search' button that would show you the search string that was used to generate the output. This search string will be based on the 'pivot' command. It will look something like:

| pivot Network_Traffic All_Traffic count(All_Traffic) AS "Count of All Traffic" SPLITROW action AS action FILTER dest_port = 22 SORT 100 action ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1

Another option is to look at the 'datamodel' search command:

| datamodel [] [<object>] []

This is documented here: http://docs.splunk.com/Documentation/Splunk/6.1.9/SearchReference/Datamodel

HTH.