Splunk Search

Is this search just counting the number of events in this datamodel?

Justin1224
Communicator

This is the search:

| tstats count from datamodel=Authentication where nodename=Authentication.Privileged_Authentication by _time span=1h | timechart span=1h count

Is this search counting the number of events in the "Priviliged_Aunthentication" node from the datamodel "Authentication" grouped into 1 hour periods?

Tags (3)
0 Karma
1 Solution

inventsekar
Ultra Champion

"Authentication" is the object name. The "nodename" on tstats is not hostname. It is to specify the node-name of the object hierarchy on CIM model.
More info about nodename.
https://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Tstats

An accelerated data model object
When you select data within an accelerated data model, you can further constrain your search by indicating an object within that data model that you want to select data from. You do this by using a where clause to indicate the nodename of the data model object. The nodename value indicates where the object is in a data model hierarchy.

When you use nodename in a search, you always use the following construction: FROM datamodel= where nodename=..<...>..

For example, say you want to search on an object named scheduled_reports in your internal_server data model. In that data model, the scheduled_reports object is a child of the scheduler object, which in turn is a child of the server root event object. This means that you should represent the scheduled_report object in your search as nodename=server.scheduler.scheduled_reports.

If you run that search and decide you want to search on the contents of the scheduler data model object instead, you would use nodename=server.scheduler in your new search.

View solution in original post

inventsekar
Ultra Champion

"Authentication" is the object name. The "nodename" on tstats is not hostname. It is to specify the node-name of the object hierarchy on CIM model.
More info about nodename.
https://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Tstats

An accelerated data model object
When you select data within an accelerated data model, you can further constrain your search by indicating an object within that data model that you want to select data from. You do this by using a where clause to indicate the nodename of the data model object. The nodename value indicates where the object is in a data model hierarchy.

When you use nodename in a search, you always use the following construction: FROM datamodel= where nodename=..<...>..

For example, say you want to search on an object named scheduled_reports in your internal_server data model. In that data model, the scheduled_reports object is a child of the scheduler object, which in turn is a child of the server root event object. This means that you should represent the scheduled_report object in your search as nodename=server.scheduler.scheduled_reports.

If you run that search and decide you want to search on the contents of the scheduler data model object instead, you would use nodename=server.scheduler in your new search.

Justin1224
Communicator

Right, so the search is doing what I described then?

0 Karma

sundareshr
Legend

You're right. However, the last timechart is not needed

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...