Splunk Enterprise Security

Network data statics dashboard

Splunk_rocks
Path Finder

Hello,

I have request to collect all network data based allowed denyed and dropped traffic info from various network feeds.
Unfortunately my network data model is not set only 15 days worth of data so i have to run manual searches to collect data so any
help will be much appreciated .
I have tried with below one but not showing all data and any help will be much appreciated

| tstats summariesonly=t allow_old_summaries=f count
 FROM datamodel=Network_Traffic.All_Traffic 
 WHERE index=* BY sourcetype All_Traffic.action _time span=1h 
 | rename All_Traffic.* AS * 
 | stats count As total_connections count(eval(action=="allowed")) AS allowed count(eval(action=="blocked" OR action=="dropped")) AS blocked BY _time, sourcetype 
 | eval pct_blocked = 100 * blocked / total_connections
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Certain things are a little unclear.

1) how much data do you want?
2) how much data is on the underlying indexes?
3) how much data is the data model set to retain?
4) have you verified that the data model is fully up to date and there are no skipped searches?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...