The |from command flattens the data model hierarchy, so the field names are the same but are no longer prefaced by the hierarchical syntax like with the |datamodel command, so you get just dest or src instead of Authentication.dest or Authentication.src ... View more

After some investigation, this is likely because you're going to Settings > Data Models > Data Model Editor from the CIM Setup page. Because CIM is a non-visible app, this breaks. I filed SPL-146820 to address this as a bug. For now, if you start in the Search and Reporting app, then go to Settings > Data Models and click a data model, everything should work fine with no 404. ... View more

This is for the excessive failed logins correlation search, correct? This correlation search tutorial actually walks through the syntax of that search, and building it with the guided search editor. http://docs.splunk.com/Documentation/ES/4.7.4/Tutorials/GuidedCorrelationSearch For your first question, Failed_Authentication is a dataset within the Authentication data model, so it's not searching 2 data models. The Failed_Authentication dataset is identified by the search constraint action=failure. The word search is there because of the way the datamodel command is used: http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Datamodel For your second question, values(Authentication.tag) looks for all the values of the Authentication.tag field. See https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Multivaluefunctions#values.28X.29 Authentication.tag is not an extracted field, but the tag field of the Authentication data model. ... View more

The error in model "Network_Resolution" has been marked as a known issue and fixed in a future version. See CIM-583 on this page: http://docs.splunk.com/Documentation/CIM/4.9.1/User/Releasenotes#Known_issues ... View more

I'm stealing this suggestion that @starcher made in the enterprise-security channel on Slack. You can make a lookup with the URLs that you want to ignore from the search, then use that lookup to drop them from the correlation search. This requires modifying the correlation search (I'd recommend making a new one from scratch, and disable the default one) So, for example, the destination field has the URLs you want dropped, leave the correlation search syntax as-is, then append the lookup at the end and dropping anything that doesn't match. Because it's a URL match, it might not be as fuzzy as you want it, but it's a start. | lookup mywhitelist destination OUTPUTNEW destination AS isFound | where isnull(isFound) ... View more

The app entry on Splunkbase includes installation guidance. It's safe to install on a distributed environment, and yours sounds fairly simple. See https://splunkbase.splunk.com/app/3435/#/details ... View more