Splunk Search

How to use EVAL Concatenation within TSTATS?

donaldwayne1975
Path Finder

Want to improve the TSTAT for the "Substantial Increase In Port Activity" correlation search.

| tstats allow_old_summaries=true count,values(All_Traffic.tag) as tag from datamodel=Network_Traffic.All_Traffic by All_Traffic.dest_port 
| `drop_dm_object_name("All_Traffic")` 
| xswhere count from count_by_dest_port_1d in network_traffic by dest_port is extreme

Was able to add the "action" field to determine if it was allowed or blocked with the below.

| tstats allow_old_summaries=true count,values(All_Traffic.tag) as tag from datamodel=Network_Traffic.All_Traffic where All_Traffic.action="allowed" by All_Traffic.dest_port All_Traffic.action 
| `drop_dm_object_name("All_Traffic")` 
| xswhere count from count_by_dest_port_1d in network_traffic by dest_port is extreme

I want to be able to use the EVAL to concatenate several fields and use the TIMECHART to determine the previous x days volume of the same traffic. I have tried the below, but it does not show results. Thoughts or suggestions for using the EVAL to concatenate within a TSTAT? Thank you in advance for your time.

| tstats allow_old_summaries=true count,values(All_Traffic.tag) as tag from datamodel=Network_Traffic.All_Traffic where All_Traffic.action="allowed" by All_Traffic.dest_port All_Traffic.action All_Traffic.dest_ip All_Traffic.src_ip
| `drop_dm_object_name("All_Traffic")` 
| xswhere count from count_by_dest_port_1d in network_traffic by dest_port is extreme
| eval session= All_Traffic.src_ip."->".All_Traffic.dest_ip."/".All_Traffic.dest_port." was ".All_Traffic.action
| timechart span=1d limit=0 count by session
0 Karma
1 Solution

donaldwayne1975
Path Finder

Welp! results show up when you include _time. answering your own question... facepalm.gif

| tstats allow_old_summaries=true count,values(All_Traffic.dest_port) AS dest_port values(All_Traffic.action) AS action values(All_Traffic.dest_ip) AS dest_ip values(All_Traffic.src_ip) AS src_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.action="allowed" by _time,All_Traffic.dest_port, All_Traffic.action, All_Traffic.dest_ip, All_Traffic.src_ip
| `drop_dm_object_name("All_Traffic")` 
| xswhere count from count_by_dest_port_1d in network_traffic by dest_port is extreme
| eval sessions = src_ip."->".dest_ip."/".dest_port." was ".action
| timechart span=1d limit=0 count by sessions

View solution in original post

0 Karma

donaldwayne1975
Path Finder

Welp! results show up when you include _time. answering your own question... facepalm.gif

| tstats allow_old_summaries=true count,values(All_Traffic.dest_port) AS dest_port values(All_Traffic.action) AS action values(All_Traffic.dest_ip) AS dest_ip values(All_Traffic.src_ip) AS src_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.action="allowed" by _time,All_Traffic.dest_port, All_Traffic.action, All_Traffic.dest_ip, All_Traffic.src_ip
| `drop_dm_object_name("All_Traffic")` 
| xswhere count from count_by_dest_port_1d in network_traffic by dest_port is extreme
| eval sessions = src_ip."->".dest_ip."/".dest_port." was ".action
| timechart span=1d limit=0 count by sessions
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...