Hi,
I've been having issues with saved searches not displaying properly. The strange thing is that this only applies to some searches and only for LDAP users.
For example the search string:
source="WinEventLog:Security" host=snzclakl098 event_id = 4625 | stats count by Account_Name
Works fine normally but when saved as a search and re-run gives this error - not enough karma to upload pictures 😞
[SimpleResultsTable module] [HTTP 404] https://127.0.0.1:9501/services/search/jobs/yong ly_eW9uZyBseQ_search_testsearch_1347410436.4208/results_preview?count=50&time_format=%25s.%25Q&output_time_format=%25Y-%25m-%25dT%25H%3A%25M%3A%25S.%25Q%25z&output_mode=xml; [{'text': 'Unknown sid.', 'code': None, 'type': 'FATAL'}]
what's weird is that this only applies to LDAP users, where as if I use a local user there's no problem.
Is it something to do with the fact that it's a flashtimeline search but it's got the stats command? I notice that without the stats command the searches are fine.. but any kind of tabling or charting seems to have issues.. again only for LDAP users.
Anyone have any ideas?
Thanks,
Yong.
