Splunk Enterprise Security

Datamodel Search is empty

b_chris21
Path Finder

Hello,

I have an issue with Endpoint Datamodel while using Enterprise Security.

Specifically I am running:

 

 

|rest splunk_server=local /services/datamodel/acceleration |fields title search

 

 

Every datamodel has a search string populated except Endpoint.

Is there an explanation for that? 

Thank you in advance.

Regards,

Chris

Labels (1)
0 Karma

lkutch_splunk
Splunk Employee
Splunk Employee

I don't know the answer for sure, but do you need to include the data set? For example: Endpoint.Ports, Endpoint.Processes, Endpoint.Services, or Endpoint.Filesystem?

https://docs.splunk.com/Documentation/CIM/4.18.0/User/Endpoint#Search_Example

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!