https://community.splunk.com/t5/Knowledge-Management/Seeing-sourcetypes-in-Endpoint-data-model/m-p/573317#M8564 <P>When searching to see which sourcetypes are in the Endpoint data model, I am getting different results if I search:</P><P><SPAN>| tstats `summariesonly` c as count from datamodel="Endpoint" by index, sourcetype</SPAN></P><P><SPAN>than when I search:</SPAN></P><P><SPAN>| tstats `summariesonly` c as count from datamodel="Endpoint.Processes" by index, sourcetype</SPAN></P><P>Why wouldn't the sourcetypes under the Processes data set be included in the first search for sourcetypes in the Endpoint data model?</P><P>Thanks.</P> Tue, 02 Nov 2021 13:53:34 GMT cswansonvt 2021-11-02T13:53:34Z https://community.splunk.com/t5/Knowledge-Management/Seeing-sourcetypes-in-Endpoint-data-model/m-p/573317#M8564 <P>When searching to see which sourcetypes are in the Endpoint data model, I am getting different results if I search:</P><P><SPAN>| tstats `summariesonly` c as count from datamodel="Endpoint" by index, sourcetype</SPAN></P><P><SPAN>than when I search:</SPAN></P><P><SPAN>| tstats `summariesonly` c as count from datamodel="Endpoint.Processes" by index, sourcetype</SPAN></P><P>Why wouldn't the sourcetypes under the Processes data set be included in the first search for sourcetypes in the Endpoint data model?</P><P>Thanks.</P> Tue, 02 Nov 2021 13:53:34 GMT https://community.splunk.com/t5/Knowledge-Management/Seeing-sourcetypes-in-Endpoint-data-model/m-p/573317#M8564 cswansonvt 2021-11-02T13:53:34Z