Splunk Enterprise

Why is endpoint data model is not fetching data from its datasets?

nehadattaramp
Loves-to-Learn

When I'm creating search query by using datamodel endpoint, unable to get result from that use case or search query.  For example: 


 datamodel=Endpoint. Processes
where Processes. process_ name IN("cat", "nano*") AND Processes. process IN("*/etc/shadow*", "*/etc. /passwd*") 


Here Processes is dataset, I only can see count of processes in numbers when I'm checking data in the pivot table.

nehadattaramp_1-1685100878512.png

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...