Splunk Enterprise Security

Splunk App for Enterprise Security: Is it possible to restrict a tstats search to a specific index?

may_aaron
Engager

I would like to restrict the tstats search below to a specific index. The search uses the IDS_Attacks datamodel in ES. Is this possible?

|`tstats` count from datamodel=Intrusion_Detection where * IDS_Attacks.ids_type=network IDS_Attacks.category=* IDS_Attacks.severity=* by _time,IDS_Attacks.severity span=10m | chart useother=`useother` count by IDS_Attacks.severity | `drop_dm_object_name("IDS_Attacks")`| sort -count
0 Karma
1 Solution

mdessus_splunk
Splunk Employee
Splunk Employee

The datamodel, as used in the CIM standard (on which ES is based), does not depends on the indexes. So, unless you modify the underlying searches or add an index field to the datamodel, it is not possible.
You'd better make sure that your data is not tagged to go in the datamodel.

View solution in original post

mdessus_splunk
Splunk Employee
Splunk Employee

The datamodel, as used in the CIM standard (on which ES is based), does not depends on the indexes. So, unless you modify the underlying searches or add an index field to the datamodel, it is not possible.
You'd better make sure that your data is not tagged to go in the datamodel.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...