Hi,
Our ES's pre-packaged datamodel (DM) Network_Traffic has 3 months of summary range. We've introduced new logs in this said DM by adding new indexes and specifying eventtypes and tags. We've confirmed by searching the datamodel that the new logs (i.e. WinEventLogs) are now included.
However, using tstats to see counts of events per day, we noticed that there's no data beyond one month ago. See:
As can be seen from above, other sourcetypes yield positive result except for the newly added sourcetype.
We were wondering why this is being the case when the DM's summary range is for 3 months. Shouldn't we be expecting to get more beyond just a month ago?
What are we missing here?
