https://community.splunk.com/t5/Splunk-Enterprise-Security/Datamodel-Search-is-empty/m-p/540279#M9710 <P>Hello,</P><P>I have an issue with Endpoint Datamodel while using Enterprise Security.</P><P>Specifically I am running:</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">|rest splunk_server=local /services/datamodel/acceleration |fields title search</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>Every datamodel has a search string populated except Endpoint.</P><P>Is there an explanation for that?&nbsp;</P><P>Thank you in advance.</P><P>Regards,</P><P>Chris</P> Wed, 17 Feb 2021 17:06:46 GMT b_chris21 2021-02-17T17:06:46Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Datamodel-Search-is-empty/m-p/540279#M9710 <P>Hello,</P><P>I have an issue with Endpoint Datamodel while using Enterprise Security.</P><P>Specifically I am running:</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">|rest splunk_server=local /services/datamodel/acceleration |fields title search</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>Every datamodel has a search string populated except Endpoint.</P><P>Is there an explanation for that?&nbsp;</P><P>Thank you in advance.</P><P>Regards,</P><P>Chris</P> Wed, 17 Feb 2021 17:06:46 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Datamodel-Search-is-empty/m-p/540279#M9710 b_chris21 2021-02-17T17:06:46Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Datamodel-Search-is-empty/m-p/540285#M9711 <P>I don't know the answer for sure, but do you need to include the data set? For example:&nbsp;<SPAN>Endpoint.Ports, Endpoint.Processes, Endpoint.Services, or Endpoint.Filesystem?</SPAN></P><P><A href="https://docs.splunk.com/Documentation/CIM/4.18.0/User/Endpoint#Search_Example" target="_blank">https://docs.splunk.com/Documentation/CIM/4.18.0/User/Endpoint#Search_Example</A></P> Wed, 17 Feb 2021 17:36:09 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Datamodel-Search-is-empty/m-p/540285#M9711 lkutch_splunk 2021-02-17T17:36:09Z