The search that drives the "Live Data"/"Must have firewall data" test for the "Sources Sending a High Volume of DNS Traffic" example is missing the 'tag=' from in front of 'network'.
Noticed in version 2.4.1 - I'm not sure if it affects earlier versions too.
Fixed in dev (and verified it wasn't copy-pasted anywhere)! This will be shipped in SSE 2.4.2, thank you!
Fixed in dev (and verified it wasn't copy-pasted anywhere)! This will be shipped in SSE 2.4.2, thank you!