Creating a Dashboard from 365 events

[donelliot]

This is weird to me - I'm not getting the same information when I create a dashboard from events than when I do it through the spl editor - it's like the same events are not being interpreted the same way. 
I've never seen this happen like this before....

The events are Microsoft:0365 events and I'm finding when I run it through SPL it works fine but when I transpose the same query to an editor some of the fields like dvc are null... 

Both the query and dashboard are created under Search and Reporting... so I'm not getting this... 

The query is a bit of a new venture for me - it's a join between the events and a union on two ldapsearches (to establish the users whose events I want to extract.. but I don't get this... 

[donelliot]

sourcetype="0365:*"
[ union
[ ldapsearch domain=blah basedn="more blah "scope="sub" search="(&(objectCategory=person)(objectClass=user))" attrs="employeeID,mail,physicalDeliveryOfficeName"
| eval email=lower(mail)
| dedup email
| fields + email
| rename email as query
| format]
[ ldapsearch domain=blah basedn="more blah " scope="sub" search="(&(objectCategory=person)(objectClass=user))" attrs="employeeID,mail,physicalDeliveryOfficeName"
| eval email=lower(mail)
| dedup email
| fields + email
| rename email as query
| format]
]
| fields - splunk_server - src_ip - ClientIP - Senderip - SenderIP - host
| eval user_id=lower(user_id)
| eval src_user = lower(src_user)
| eval user=lower(user)
| search (user="*") (Operation="*") | fillnull value="Not Found" user Operation dvc
| eval myfield = Operation + " | " + user
| timechart count by Operation limit=0

[bowesmana]

When you get strange differences in results like this, it can often be a result of the use of subsearches, which have limitations. In the Job dropdown, you may see that it has discarded events from the subsearches due to exceeding limits.

Subsearch will probably be finalised after 60 seconds, so this could account for your varability.

Check the job search.log and see if there are any warnings and how long your search is running.