Splunk Enterprise

Why is endpoint data model is not fetching data from its datasets?

nehadattaramp
Loves-to-Learn

When I'm creating search query by using datamodel endpoint, unable to get result from that use case or search query.  For example: 


 datamodel=Endpoint. Processes
where Processes. process_ name IN("cat", "nano*") AND Processes. process IN("*/etc/shadow*", "*/etc. /passwd*") 


Here Processes is dataset, I only can see count of processes in numbers when I'm checking data in the pivot table.

nehadattaramp_1-1685100878512.png

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

SOC Modernization: How Automation and Splunk SOAR are Shaping the Next-Gen Security ...

Security automation is no longer a luxury but a necessity. Join us to learn how Splunk ES and SOAR empower ...

Ask It, Fix It: Faster Investigations with AI Assistant in Observability Cloud

  Join us in this Tech Talk and learn about the recently launched AI Assistant in Observability Cloud. With ...

Index This | How many sides does a circle have?

  March 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...