Splunk Search

undefined

romanpro
Loves-to-Learn Everything

 

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This query appears to be unsuitable for conversion to  tstats.  It uses too many fields that must all be indexed for tstats to supply them.  Also, the query is doing its own analysis of the events, but tstats provides aggregated values, not events, which would break the calculations done in the query.

What problem are you trying to solve?  Perhaps tstats is not part of the answer.

---
If this reply helps you, Karma would be appreciated.

romanpro
Loves-to-Learn Everything

I already converted up to this part 

| tstats count from datamodel=Cisco_Security.Secure_Malware_Analytics_Dataset where nodename=Secure_Malware_Analytics_Dataset index=* status IN ("*") sourcetype="cisco:sma:submissions"

It works as expected but I stuck to complete now

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm sure you are stuck, as expected.

The current tstats command produces only one field: count.  You can get some (and maybe all) of them using the list or values function, but any association between the fields will be lost.

For example,.

| tstats count, values(analysis.threat_score) as ats, values(analysis.metadata.sandcastle_env.analysis_start) as start, ... from datamodel=Cisco_Security.Secure_Malware_Analytics_Dataset where nodename=Secure_Malware_Analytics_Dataset index=* status IN ("*") sourcetype="cisco:sma:submissions"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...