i do have the following problem:
index=atmo_pc sourcetype=SE10 Station=60
as you can see, my search is pretty basic. It is just a small part of a whole Dashboard, which depends on the selected Station. Furthermore events with Station=60 arent shown properly. Actually the result's 4 events if i press search (Year to date-Time-Picker).
if i modify the search like:
index=atmo_pc sourcetype=SE10 Station<61 Station>59
i receive more than 7000 events, which is the correct number of events.
So i cannot figure out why. I dont think it is a problem regarding the Field Extractions or any other settings. Is it a problem of the source? Thanks for any help!
After hitting this search
index=atmo_pc sourcetype=SE10 Station<61 Station>59 what values do you get in the field sidebar for
Do you get only