Splunk Enterprise Security

Splunk App for Enterprise Security: Is it possible to restrict a tstats search to a specific index?

may_aaron
Engager

I would like to restrict the tstats search below to a specific index. The search uses the IDS_Attacks datamodel in ES. Is this possible?

|`tstats` count from datamodel=Intrusion_Detection where * IDS_Attacks.ids_type=network IDS_Attacks.category=* IDS_Attacks.severity=* by _time,IDS_Attacks.severity span=10m | chart useother=`useother` count by IDS_Attacks.severity | `drop_dm_object_name("IDS_Attacks")`| sort -count
0 Karma
1 Solution

mdessus_splunk
Splunk Employee
Splunk Employee

The datamodel, as used in the CIM standard (on which ES is based), does not depends on the indexes. So, unless you modify the underlying searches or add an index field to the datamodel, it is not possible.
You'd better make sure that your data is not tagged to go in the datamodel.

View solution in original post

mdessus_splunk
Splunk Employee
Splunk Employee

The datamodel, as used in the CIM standard (on which ES is based), does not depends on the indexes. So, unless you modify the underlying searches or add an index field to the datamodel, it is not possible.
You'd better make sure that your data is not tagged to go in the datamodel.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...