https://community.splunk.com/t5/Splunk-Search/Wrong-values-in-the-field-within-data-model/m-p/540706#M153002 <P>Are you referring to the Registry data set in the Endpoint data model?</P><P>If your data is incorrect, you have field aliases, calculated fields, or field extractions on <EM>tag=endpoint tag=registry&nbsp;</EM>events that produce incorrect results. This could include automatic extractions on raw event text like "user=foo.exe."</P><P>Start by determining which field-value pairs identify <EM>tag=registry</EM>. You can use Settings &gt; Tags &gt; List by tag name in the UI or run 'splunk cmd btool tags list --debug' on your instance. From there, review and correct knowledge objects for the related events.</P><P>You can rebuild the data model or leave old, incorrect data in place while new events populate the data model correctly going forward, depending on your requirements.</P> Sun, 21 Feb 2021 07:01:50 GMT tscroggins 2021-02-21T07:01:50Z https://community.splunk.com/t5/Splunk-Search/Wrong-values-in-the-field-within-data-model/m-p/537595#M151998 <P>Hi,</P><P>I'm searching through the Registry data model and I noticed that in the field "user" I've got process names. How to fix it?</P><P>As far as I know, after fixing it - so in the "user" field there is actually a user name, I will need to rebuild the whole data model, right?</P><P>Will I need to take some extra steps if this data model is accelerated?</P> Thu, 28 Jan 2021 10:35:56 GMT https://community.splunk.com/t5/Splunk-Search/Wrong-values-in-the-field-within-data-model/m-p/537595#M151998 fedejko 2021-01-28T10:35:56Z https://community.splunk.com/t5/Splunk-Search/Wrong-values-in-the-field-within-data-model/m-p/540706#M153002 <P>Are you referring to the Registry data set in the Endpoint data model?</P><P>If your data is incorrect, you have field aliases, calculated fields, or field extractions on <EM>tag=endpoint tag=registry&nbsp;</EM>events that produce incorrect results. This could include automatic extractions on raw event text like "user=foo.exe."</P><P>Start by determining which field-value pairs identify <EM>tag=registry</EM>. You can use Settings &gt; Tags &gt; List by tag name in the UI or run 'splunk cmd btool tags list --debug' on your instance. From there, review and correct knowledge objects for the related events.</P><P>You can rebuild the data model or leave old, incorrect data in place while new events populate the data model correctly going forward, depending on your requirements.</P> Sun, 21 Feb 2021 07:01:50 GMT https://community.splunk.com/t5/Splunk-Search/Wrong-values-in-the-field-within-data-model/m-p/540706#M153002 tscroggins 2021-02-21T07:01:50Z