Hello, i face strugling to make base search using a datamodel with tstats command. My objective is to make dashboard easily access with tsats datamodels and chain search for each panel with that. This my sample
| tstats summariesonly=true
values(Vulnerabilities_Custom.Vulnerabilities_Non_Remediation.dest) as dest
values(Vulnerabilities_Custom.Vulnerabilities_Non_Remediation.hostname) as hostname
values(Vulnerabilities_Custom.Vulnerabilities_Non_Remediation.os_type) as os_type
values(Vulnerabilities_Custom.Vulnerabilities_Non_Remediation.exploit_title) as exploit_title
values(Vulnerabilities_Custom.Vulnerabilities_Non_Remediation.malware_title) as malware_title
from datamodel=Vulnerabilities_Custom.Vulnerabilities_Non_Remediation
where nodename IN ("Vulnerabilities_Custom.Vulnerabilities_Non_Remediation",
"Vulnerabilities_Custom.High_Or_Critical_Vulnerabilities_Non_Remediation",
"Vulnerabilities_Custom.Medium_Vulnerabilities_Non_Remediation",
"Vulnerabilities_Custom.Low_Or_Informational_Vulnerabilities_Non_Remediation")
by Vulnerabilities_Custom.Vulnerabilities_Non_Remediation._time, Vulnerabilities_Custom.Vulnerabilities_Non_Remediation.dest
| table event_time dest hostname os_type exploit_title malware_titleHas anyone have clues about this?
You haven't asked a question. I assume your base tstats search does work (I don't have data to test it).
Anyway, your base search (the tstats alone) will give you possibly multivalued fields for which there is no relation between atomic values (this might be what you want but it often isn't).
It will also give you data splt by fields you're not including in your table command.
And you will probably get a lot of data as a result - almost as if you were searching raw data. It's not how you use base search - you'll probably get way too many base results to work with.
allright, i still learn for this tstats queries.
my update for this issue is still struggling to match values from one queries for display in dashboard to its event details. I assumed it cause the parameter from the query. but in other side i want show other field related with the event, even that field empyt.
I open this issue here:
Best approach using tstats for splunk dashboard an... - Splunk Community