Splunk Search

Sourcetype not same in index & tstats

warsaw
Loves-to-Learn Lots

I am trying to create a query using tstats from datamodel Malware, one of the sourcetype 'abc'  that i want to include is coming up in index search but not in datamodel tstats search, the index is already mapped with Malware datamodel, is this possible?

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

So, most probably the events that missing has not requires tagging for Malware datamodel. Since datamodels are working based on tags, Malware model searches the events with "malware" and "attack" tags. Please check the missing events tags with below search. 

index=missing_index sourcetype=abc | stats count by tag

If you don't see "malware" and "attack" tags you should check eventide and tag settings for missing sourcetypes.

https://docs.splunk.com/Documentation/CIM/4.18.0/User/Malware 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

warsaw
Loves-to-Learn Lots

@scelikok yes i checked that already, that datamodel is constrained by index only not sourcetype.

Also i checked the concerned index is having 9-10 sourcetype whereas my datamodel is having only 4, i checked both for same time range.

0 Karma

scelikok
SplunkTrust
SplunkTrust

@warsaw , data models constraints can be set by index and sourcetypes too. Maybe your Malware model is restricted to only some spesific sourcetypes from that index.

You can go to settings / Data Models / here you can click on each data model and see in the constraint which macro the DM is using, and then you can modify that under Settings/Advanced Search/Macros.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...