In some cases, I encounter problems with parsing data using CIM datamodel on windows event log data.   For example,  when searching for deleted and created user accounts using datamodel: | from datamodel:"Change"."Account_Management" | search (action="created" OR action="deleted") "User" field is calulated correctly for "created" 4720 events.  This field calculation does not work correctly for 4726 events, where user and source user fields are returned as unknwon (even though they are present in raw log data).  I am using Splunk TA for windows to ingest data.    What may be the cause of this behavior?  ... View more