How do I fix DLP datamodel with one Event it self?

[AL3Z]

Hi,

I didnt see any fields from the dlp datamodel apart from 1 event ,what we fix this to get all the fields and events ?

[VatsalJagani]

@AL3Z - I can see you are searching for last 30 minutes only. Try increasing the timerange to see if you have more details.

I hope this helps!!!

[AL3Z]

Hi Vatsal,

Even if we search for  24 hours or 7days it is showing the same output.

[VatsalJagani]

@AL3Z - You need to check the events field extraction for data-model mapping.

You can use this for learning - https://www.youtube.com/watch?v=cJw3IAgbBV0

I hope this helps!!!

[AL3Z]

Hi,
If I  use the |datamodel DLP DLP_Incidents search its populating all the fields with out search  at the end its not giving all the fields why ?

[VatsalJagani]

That's how the datamodel command should work. Read more here - https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/Datamodel#.26lt.3Bdata_model_sear...

I hope this helps!!!