Knowledge Management

Seeing sourcetypes in Endpoint data model

New Member

When searching to see which sourcetypes are in the Endpoint data model, I am getting different results if I search:

| tstats `summariesonly` c as count from datamodel="Endpoint" by index, sourcetype

than when I search:

| tstats `summariesonly` c as count from datamodel="Endpoint.Processes" by index, sourcetype

Why wouldn't the sourcetypes under the Processes data set be included in the first search for sourcetypes in the Endpoint data model?


Labels (1)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!