Hi,
I want to display time on my dashboard but all I see just two fields with data any help with the search to populate the rest of the fields would be appreciated.
I have attached my dashboard.
my search that looks like this:
Index=a sourcetype=b earliest=-1d
[| inputlookup M003_siem_ass_list where FMA_id=*OS -001* | stats values(ass) as search
| eval seaqqrch=mvjoin(search,", OR ")]
| fields ip FMA_id _time d_role
| stats latest(_time) as _time values(*) by ip
Time only displays well when it is used as the x-axis on charts.