Hi Team,
I have recently mapped new sourcetypes to the Web data model, however, when searching using tstats, none of the new sourcetypes are returned in the search results.
When I run the below search, I can see that data from my websense, squid and bluecoat proxies are present in the data model
| datamodel Web Web search | search * | stats count by index, sourcetype | sort -count
However, when attempting to search the data model using tstats, only websense and squid show up in the search results.
| tstats summariesonly=t prestats=f count from datamodel=Web.Web WHERE sourcetype=* BY sourcetype Web.src Web.site Web.dest Web.url | dedup sourcetype
Does anyone have any ideas what has gone wrong?
I had this issue
A data model names Web that includes my WAF source type
I created another DM named after my WAF, this caused my WAF not to show in the results as a sourcetype when querying the Web DM
So i removed the created DM and it worked again
is the acceleration completed? and if your are doing by sourcetype why sourcetype=*, is sourcetype field has null values?
can confirm, data model acceleration is at 100%. sourcetype=* was chosen as sourcetype=bluecoat wasn't working and wanted to see if any of the other sourcetypes were present in the search results.