Unable to find tag security

[damode]

I am getting the error - Unable to find tag security on the below panels on the security posture dashboard.

360 View by Accounts: Event Types over

Search : `infosec-indexes (tag=security OR tag=attack) | eval tag=mvfilter(match(tag, "failure") OR match(tag, "success") OR match(tag, "access") OR match(tag, "add") OR match(tag, "change") OR match(tag, "delete") OR match(tag, "error") OR match(tag, "misconfiguration") OR match(tag, "vulnerability") OR match(tag, "attack") OR match(tag, "lock") OR match(tag, "cleared") OR match(tag, "email")) | stats count, dc(user) by date_hour, tag`

Time 360 View by hosts: Event Types over Time

I checked all the tags and there is no security tag but there are definitely mutiple tags called attack, still the search within the mentioned panels is not working.

Please advise.

[igifrin_splunk]

Are you getting a warning message like the one on the screenshot below?

If that's the case, you should still see correct results on the dashboard panel for the data you have; you just don't have data with tag=security as you pointed out.

This may not be a bad warning to see. For example, it can be an indication that you don't have Windows security logs or you are not using Windows add-on that add the 'security' tag.