Splunk Search

How do I search using a data model?

New Member

I've been working on a report that shows the dropped or blocked traffic using the interesting ports lookup table. I want to change this to search the network data model so I'm not using the * for my index. Any help on this would be great. Thanks.

index=* action="blocked" OR action="dropped"  [| inputlookup interesting_ports_lookup | fields dest_port] | table dest_port, dest_ip, src, app
0 Karma

SplunkTrust
SplunkTrust

See the documentation to learn how to create data models

http://docs.splunk.com/Documentation/Splunk/6.0/PivotTutorial/Buildtutorialdatamodel

0 Karma

SplunkTrust
SplunkTrust

Hi,

Take a look at the following two commands:

You can also search on accelerated data models by using the tstats command.

Hope that helps.

Thanks,
J

New Member

I have my data model search here

| datamodel NetworkTraffic AllTraffic search | table All_Traffic.action

I just want to know if I can combine the two searches.

0 Karma

SplunkTrust
SplunkTrust

Sorry I'm not sure what you meant there, some characters seem to be missing.
Can you post your searches again but using the Code format button?

You can combine both searches yes, but it all depends on what you are trying to achieve.
If you paste both searches and tell us what your goal is we might be able to help.

My guess based on your first comment is that you are trying to integrate datamodel with your lookup. Can you confirm this is the case? If so you can either build the lookup into your datamodel or pipe it in the same way as you would do with a normal lookup. Take a look at this:

http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/Aboutdatamodels

Data models can get their fields from extractions that you set up in the Field Extractions section of Manager or by configured directly in props.conf and transforms.conf. When you define your data model, you can arrange to have it get additional fields at search time through regular-expression-based field extractions, lookups, and eval expressions.

Thanks,
J

0 Karma

New Member

Yes I'm trying to integrate the network data model with my lookup table. I want to search our network data model that we have already setup.

0 Karma