The sourcetype is customized, not default accesscombined/accesscustom format. I can preview the data after setting the sourcetype in setup page. But the dashboard returns "No Results found". Can web intelligence only work in default sourcetype access_combined? The "data exploration -> search " can return result even I don't point out the sourcetype in the query. Thanks.
Please take a look at the following:
The one thing I can think is the format of your sourcetype needs to match the expected access logs.
If you have a customized web log format, you may need to use Field Extraction to get the fields out of the log, depending on what your log looks like (can you tell us?).
Once you have extracted the fields, depending on how they are extracted, you may need to use Field Alias to make sure the fields are named correctly. Here is a list of field aliases that may be needed, taken from [access-extractions] in default/transforms.conf
[access-extractions] # matches access-common or access-combined apache logging formats # Extracts: clientip, clientport, ident, user, req_time, method, uri, root, file, uri_domain, uri_query, version, status, bytes, referer_url, referer_domain, referer_proto, useragent, cookie, other (remaining chars) # Note: referer is misspelled in purpose because that is the "official" spelling for "HTTP referer"