Splunk Search

Using tsats from datamodels become base search on splunk dashboard

elend
Communicator

Hello, i face strugling to make base search using a datamodel with tstats command. My objective is to make dashboard easily access with tsats datamodels and chain search for each panel with that. This my sample 

| tstats summariesonly=true
    values(Vulnerabilities_Custom.Vulnerabilities_Non_Remediation.dest) as dest 
    values(Vulnerabilities_Custom.Vulnerabilities_Non_Remediation.hostname) as hostname 
    values(Vulnerabilities_Custom.Vulnerabilities_Non_Remediation.os_type) as os_type 
    values(Vulnerabilities_Custom.Vulnerabilities_Non_Remediation.exploit_title) as exploit_title 
    values(Vulnerabilities_Custom.Vulnerabilities_Non_Remediation.malware_title) as malware_title 
from datamodel=Vulnerabilities_Custom.Vulnerabilities_Non_Remediation 
    where nodename IN ("Vulnerabilities_Custom.Vulnerabilities_Non_Remediation", 
                       "Vulnerabilities_Custom.High_Or_Critical_Vulnerabilities_Non_Remediation", 
                       "Vulnerabilities_Custom.Medium_Vulnerabilities_Non_Remediation", 
                       "Vulnerabilities_Custom.Low_Or_Informational_Vulnerabilities_Non_Remediation") 
by Vulnerabilities_Custom.Vulnerabilities_Non_Remediation._time, Vulnerabilities_Custom.Vulnerabilities_Non_Remediation.dest
| table event_time dest hostname os_type exploit_title malware_title

 Has anyone have clues about this? 

 

Labels (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

You haven't asked a question. I assume your base tstats search does work (I don't have data to test it).

Anyway, your base search (the tstats alone) will give you possibly multivalued fields for which there is no relation between atomic values (this might be what you want but it often isn't).

It will also give you data splt by fields you're not including in your table command.

And you will probably get a lot of data as a result - almost as if you were searching raw data. It's not how you use base search - you'll probably get way too many base results to work with.

0 Karma

elend
Communicator

allright, i still learn for this tstats queries. 
my update for this issue is still struggling to match values from one queries for display in dashboard to its event details. I assumed it cause the parameter from the query. but in other side i want show other field related with the event, even that field empyt. 
I open this issue here:
Best approach using tstats for splunk dashboard an... - Splunk Community

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...