Get More Flexibility and Accelerated Searches with the New Endpoint Data Model

[sorangutan]

November's Splunk Enterprise Security Content Update (ESCU) releases included some powerful updates, adapting searches to leverage the new Endpoint Data Model

https://www.splunk.com/blog/2018/12/03/get-more-flexibility-and-accelerated-searches-with-the-new-endpoint-data-model.html