Splunk Search

Sourcetype not same in index & tstats

warsaw
Loves-to-Learn Lots

I am trying to create a query using tstats from datamodel Malware, one of the sourcetype 'abc'  that i want to include is coming up in index search but not in datamodel tstats search, the index is already mapped with Malware datamodel, is this possible?

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

So, most probably the events that missing has not requires tagging for Malware datamodel. Since datamodels are working based on tags, Malware model searches the events with "malware" and "attack" tags. Please check the missing events tags with below search. 

index=missing_index sourcetype=abc | stats count by tag

If you don't see "malware" and "attack" tags you should check eventide and tag settings for missing sourcetypes.

https://docs.splunk.com/Documentation/CIM/4.18.0/User/Malware 

If this reply helps you an upvote is appreciated.
0 Karma

warsaw
Loves-to-Learn Lots

@scelikok yes i checked that already, that datamodel is constrained by index only not sourcetype.

Also i checked the concerned index is having 9-10 sourcetype whereas my datamodel is having only 4, i checked both for same time range.

0 Karma

scelikok
SplunkTrust
SplunkTrust

@warsaw , data models constraints can be set by index and sourcetypes too. Maybe your Malware model is restricted to only some spesific sourcetypes from that index.

You can go to settings / Data Models / here you can click on each data model and see in the constraint which macro the DM is using, and then you can modify that under Settings/Advanced Search/Macros.

If this reply helps you an upvote is appreciated.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>