I've been working on a report that shows the dropped or blocked traffic using the interesting ports lookup table. I want to change this to search the network data model so I'm not using the
* for my index. Any help on this would be great. Thanks.
index=* action="blocked" OR action="dropped" [| inputlookup interesting_ports_lookup | fields dest_port] | table dest_port, dest_ip, src, app
Sorry I'm not sure what you meant there, some characters seem to be missing.
Can you post your searches again but using the Code format button?
You can combine both searches yes, but it all depends on what you are trying to achieve.
If you paste both searches and tell us what your goal is we might be able to help.
My guess based on your first comment is that you are trying to integrate datamodel with your lookup. Can you confirm this is the case? If so you can either build the lookup into your datamodel or pipe it in the same way as you would do with a normal lookup. Take a look at this:
Data models can get their fields from extractions that you set up in the Field Extractions section of Manager or by configured directly in props.conf and transforms.conf. When you define your data model, you can arrange to have it get additional fields at search time through regular-expression-based field extractions, lookups, and eval expressions.