Splunk Search

Is this search just counting the number of events in this datamodel?

Justin1224
Communicator

This is the search:

| tstats count from datamodel=Authentication where nodename=Authentication.Privileged_Authentication by _time span=1h | timechart span=1h count

Is this search counting the number of events in the "Priviliged_Aunthentication" node from the datamodel "Authentication" grouped into 1 hour periods?

Tags (3)
0 Karma
1 Solution

inventsekar
Super Champion

"Authentication" is the object name. The "nodename" on tstats is not hostname. It is to specify the node-name of the object hierarchy on CIM model.
More info about nodename.
https://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Tstats

An accelerated data model object
When you select data within an accelerated data model, you can further constrain your search by indicating an object within that data model that you want to select data from. You do this by using a where clause to indicate the nodename of the data model object. The nodename value indicates where the object is in a data model hierarchy.

When you use nodename in a search, you always use the following construction: FROM datamodel= where nodename=..<...>..

For example, say you want to search on an object named scheduled_reports in your internal_server data model. In that data model, the scheduled_reports object is a child of the scheduler object, which in turn is a child of the server root event object. This means that you should represent the scheduled_report object in your search as nodename=server.scheduler.scheduled_reports.

If you run that search and decide you want to search on the contents of the scheduler data model object instead, you would use nodename=server.scheduler in your new search.

View solution in original post

inventsekar
Super Champion

"Authentication" is the object name. The "nodename" on tstats is not hostname. It is to specify the node-name of the object hierarchy on CIM model.
More info about nodename.
https://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Tstats

An accelerated data model object
When you select data within an accelerated data model, you can further constrain your search by indicating an object within that data model that you want to select data from. You do this by using a where clause to indicate the nodename of the data model object. The nodename value indicates where the object is in a data model hierarchy.

When you use nodename in a search, you always use the following construction: FROM datamodel= where nodename=..<...>..

For example, say you want to search on an object named scheduled_reports in your internal_server data model. In that data model, the scheduled_reports object is a child of the scheduler object, which in turn is a child of the server root event object. This means that you should represent the scheduled_report object in your search as nodename=server.scheduler.scheduled_reports.

If you run that search and decide you want to search on the contents of the scheduler data model object instead, you would use nodename=server.scheduler in your new search.

View solution in original post

Justin1224
Communicator

Right, so the search is doing what I described then?

0 Karma

sundareshr
Legend

You're right. However, the last timechart is not needed

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!