Splunk Search

Using tsats from datamodels become base search on splunk dashboard

elend
Communicator

Hello, i face strugling to make base search using a datamodel with tstats command. My objective is to make dashboard easily access with tsats datamodels and chain search for each panel with that. This my sample 

| tstats summariesonly=true
    values(Vulnerabilities_Custom.Vulnerabilities_Non_Remediation.dest) as dest 
    values(Vulnerabilities_Custom.Vulnerabilities_Non_Remediation.hostname) as hostname 
    values(Vulnerabilities_Custom.Vulnerabilities_Non_Remediation.os_type) as os_type 
    values(Vulnerabilities_Custom.Vulnerabilities_Non_Remediation.exploit_title) as exploit_title 
    values(Vulnerabilities_Custom.Vulnerabilities_Non_Remediation.malware_title) as malware_title 
from datamodel=Vulnerabilities_Custom.Vulnerabilities_Non_Remediation 
    where nodename IN ("Vulnerabilities_Custom.Vulnerabilities_Non_Remediation", 
                       "Vulnerabilities_Custom.High_Or_Critical_Vulnerabilities_Non_Remediation", 
                       "Vulnerabilities_Custom.Medium_Vulnerabilities_Non_Remediation", 
                       "Vulnerabilities_Custom.Low_Or_Informational_Vulnerabilities_Non_Remediation") 
by Vulnerabilities_Custom.Vulnerabilities_Non_Remediation._time, Vulnerabilities_Custom.Vulnerabilities_Non_Remediation.dest
| table event_time dest hostname os_type exploit_title malware_title

 Has anyone have clues about this? 

 

Labels (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

You haven't asked a question. I assume your base tstats search does work (I don't have data to test it).

Anyway, your base search (the tstats alone) will give you possibly multivalued fields for which there is no relation between atomic values (this might be what you want but it often isn't).

It will also give you data splt by fields you're not including in your table command.

And you will probably get a lot of data as a result - almost as if you were searching raw data. It's not how you use base search - you'll probably get way too many base results to work with.

0 Karma

elend
Communicator

allright, i still learn for this tstats queries. 
my update for this issue is still struggling to match values from one queries for display in dashboard to its event details. I assumed it cause the parameter from the query. but in other side i want show other field related with the event, even that field empyt. 
I open this issue here:
Best approach using tstats for splunk dashboard an... - Splunk Community

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...