When searching to see which sourcetypes are in the Endpoint data model, I am getting different results if I search:
| tstats `summariesonly` c as count from datamodel="Endpoint" by index, sourcetype
than when I search:
| tstats `summariesonly` c as count from datamodel="Endpoint.Processes" by index, sourcetype
Why wouldn't the sourcetypes under the Processes data set be included in the first search for sourcetypes in the Endpoint data model?
Thanks.
