Sourcetype not same in index & tstats

[warsaw]

I am trying to create a query using tstats from datamodel Malware, one of the sourcetype 'abc'  that i want to include is coming up in index search but not in datamodel tstats search, the index is already mapped with Malware datamodel, is this possible?

[scelikok]

So, most probably the events that missing has not requires tagging for Malware datamodel. Since datamodels are working based on tags, Malware model searches the events with "malware" and "attack" tags. Please check the missing events tags with below search. 

index=missing_index sourcetype=abc | stats count by tag

If you don't see "malware" and "attack" tags you should check eventide and tag settings for missing sourcetypes.

https://docs.splunk.com/Documentation/CIM/4.18.0/User/Malware 

[warsaw]

@scelikok yes i checked that already, that datamodel is constrained by index only not sourcetype.

Also i checked the concerned index is having 9-10 sourcetype whereas my datamodel is having only 4, i checked both for same time range.

[scelikok]

@warsaw , data models constraints can be set by index and sourcetypes too. Maybe your Malware model is restricted to only some spesific sourcetypes from that index.

You can go to settings / Data Models / here you can click on each data model and see in the constraint which macro the DM is using, and then you can modify that under Settings/Advanced Search/Macros.