https://community.splunk.com/t5/Dashboards-Visualizations/Creating-a-Dashboard-from-365-events/m-p/539830#M36987 <P>When you get strange differences in results like this, it can often be a result of the use of subsearches, which have limitations. In the Job dropdown, you may see that it has discarded events from the subsearches due to exceeding limits.</P><P>Subsearch will probably be finalised after 60 seconds, so this could account for your varability.</P><P>Check the job search.log and see if there are any warnings and how long your search is running.</P><P>&nbsp;</P> Sun, 14 Feb 2021 08:12:20 GMT bowesmana 2021-02-14T08:12:20Z https://community.splunk.com/t5/Dashboards-Visualizations/Creating-a-Dashboard-from-365-events/m-p/539796#M36973 <P>This is weird to me - I'm not getting the same information when I create a dashboard from events than when I do it through the spl editor - it's like the same events are not being interpreted the same way.&nbsp;<BR />I've never seen this happen like this before....<BR /><BR />The events are Microsoft:0365 events and I'm finding when I run it through SPL it works fine but when I transpose the same query to an editor some of the fields like dvc are null...&nbsp;<BR /><BR />Both the query and dashboard are created under Search and Reporting... so I'm not getting this...&nbsp;<BR /><BR />The query is a bit of a new venture for me - it's a join between the events and a union on two ldapsearches (to establish the users whose events I want to extract.. but I don't get this...&nbsp;</P> Sat, 13 Feb 2021 16:33:37 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Creating-a-Dashboard-from-365-events/m-p/539796#M36973 donelliot 2021-02-13T16:33:37Z https://community.splunk.com/t5/Dashboards-Visualizations/Creating-a-Dashboard-from-365-events/m-p/539818#M36985 <P>sourcetype="0365:*"<BR />[ union<BR />[ ldapsearch domain=blah basedn="more blah "scope="sub" search="(&amp;(objectCategory=person)(objectClass=user))" attrs="employeeID,mail,physicalDeliveryOfficeName"<BR />| eval email=lower(mail)<BR />| dedup email<BR />| fields + email<BR />| rename email as query<BR />| format]<BR />[ ldapsearch domain=blah basedn="more blah " scope="sub" search="(&amp;(objectCategory=person)(objectClass=user))" attrs="employeeID,mail,physicalDeliveryOfficeName"<BR />| eval email=lower(mail)<BR />| dedup email<BR />| fields + email<BR />| rename email as query<BR />| format]<BR />]<BR />| fields - splunk_server - src_ip - ClientIP - Senderip - SenderIP - host<BR />| eval user_id=lower(user_id)<BR />| eval src_user = lower(src_user)<BR />| eval user=lower(user)<BR />| search (user="*") (Operation="*") | fillnull value="Not Found" user Operation dvc<BR />| eval myfield = Operation + " | " + user<BR />| timechart count by Operation limit=0</P> Sat, 13 Feb 2021 22:38:56 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Creating-a-Dashboard-from-365-events/m-p/539818#M36985 donelliot 2021-02-13T22:38:56Z https://community.splunk.com/t5/Dashboards-Visualizations/Creating-a-Dashboard-from-365-events/m-p/539830#M36987 <P>When you get strange differences in results like this, it can often be a result of the use of subsearches, which have limitations. In the Job dropdown, you may see that it has discarded events from the subsearches due to exceeding limits.</P><P>Subsearch will probably be finalised after 60 seconds, so this could account for your varability.</P><P>Check the job search.log and see if there are any warnings and how long your search is running.</P><P>&nbsp;</P> Sun, 14 Feb 2021 08:12:20 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Creating-a-Dashboard-from-365-events/m-p/539830#M36987 bowesmana 2021-02-14T08:12:20Z