I'm trying to use the CIM to look at some firewall data in the InfoSec app. I've setup the event tagging and field aliases but I'm getting different results when searching using the Datamodel in the InfoSec dashboard vs using a base search. Here are the two searches I'm using, anyone know why they are providing different results?
Datamodel: | tstats prestats=true local=false summariesonly=true allow_old_summaries=true count from datamodel=Network_Traffic.All_Traffic where * by _time, All_Traffic.action span=10m | timechart minspan=10m count by All_Traffic.action
Base: tag=communicate tag=network | stats count by _time,action | timechart minspan=10m count by action
Thanks
