Splunk Search

undefined

romanpro
Loves-to-Learn Everything

 

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This query appears to be unsuitable for conversion to  tstats.  It uses too many fields that must all be indexed for tstats to supply them.  Also, the query is doing its own analysis of the events, but tstats provides aggregated values, not events, which would break the calculations done in the query.

What problem are you trying to solve?  Perhaps tstats is not part of the answer.

---
If this reply helps you, Karma would be appreciated.

romanpro
Loves-to-Learn Everything

I already converted up to this part 

| tstats count from datamodel=Cisco_Security.Secure_Malware_Analytics_Dataset where nodename=Secure_Malware_Analytics_Dataset index=* status IN ("*") sourcetype="cisco:sma:submissions"

It works as expected but I stuck to complete now

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm sure you are stuck, as expected.

The current tstats command produces only one field: count.  You can get some (and maybe all) of them using the list or values function, but any association between the fields will be lost.

For example,.

| tstats count, values(analysis.threat_score) as ats, values(analysis.metadata.sandcastle_env.analysis_start) as start, ... from datamodel=Cisco_Security.Secure_Malware_Analytics_Dataset where nodename=Secure_Malware_Analytics_Dataset index=* status IN ("*") sourcetype="cisco:sma:submissions"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...