issue in correlation search

[kjain041523]

| tstats summariesonly count dc(IDS_Attacks.dest) as dest from datamodel=Intrusion_Detection.IDS_Attacks where * by IDS_Attacks.src IDS_Attacks.signature _time | drop_dm_object_name("IDS_Attacks") | search NOT signature=Unknown* signature="Vulnerability exploit detection(32796)"


please provide the correct splunk query to display raw events and statistics

[gcusello]

Hi @kjain041523 ,

if you use a Data Model, you don't have raw data, so you have to divide the output in two panel with two searches (one using DM for statistics and one using indexes for raw data, eventually filtering results from the first panel) or use indexes.

Using indexes in one search, you could try something like this:

(`cim_Intrusion_Detection_indexes`) tag=ids tag=attack
| stats 
     count 
     dc(IDS_Attacks.dest) as dest 
     values(_raw) AS _raw
     by src signature _time 
| `drop_dm_object_name("IDS_Attacks")` 
| search NOT signature=Unknown* signature="Vulnerability exploit detection(32796)"

Ciao.

Giuseppe

P.S.: WHERE * has no sense!

[PickleRick]

1. What do you mean by "statistics" here?

2. If you use tstats with datamodel summaries, you don't deal with raw events.

[ITWhisperer]

What is wrong with what you already have tried?