Why is endpoint data model is not fetching data from its datasets?

nehadattaramp — Thu, 01 Jun 2023 10:25:01 GMT

When I'm creating search query by using datamodel endpoint, unable to get result from that use case or search query. For example:

datamodel=Endpoint. Processes
where Processes. process_ name IN("cat", "nano*") AND Processes. process IN("*/etc/shadow*", "*/etc. /passwd*")

Here Processes is dataset, I only can see count of processes in numbers when I'm checking data in the pivot table.

topic Why is endpoint data model is not fetching data from its datasets? in Splunk Enterprise