OK, so take for example this query
index=aws sourcetype=* earliest=-30d user="*" action=login OR action=logout | table user status action reason message
If you run this query in verbose mode (but do last 15 minutes, not last 30 days), then in the events tab, you will see a list of fields. Do the fields you are using in the search exist?
Do you have permission to view events in the aws index?
In you just use index=aws for the last 15 minutes, do you see any data?
do you have the user and action fields and if you have action, what are the values.
If you are seeing nothing, then it will be one of
- permissons to the data
- fields not being extracted, so your search will not work
The best way to resolve this is to look at the field list (in verbose mode) so you can see the extracted fields and their typical values
