Splunk searches relating to Datamodels

clear
| from datamodel:"Authentication"."Authentication" | search action=failure OR action=success | streamstats window=0 current=true reset_after="(action=\"success\")" count as failure_count by user | where action="success" and failure_count > 10 | stats values(failure_count) as failure_count by user
0 comments
| datamodel Network_Traffic All_Traffic search | dedup All_Traffic.dest | stats count by All_Traffic.src_ip, All_Traffic.dest,All_Traffic.action
0 comments