This is a totally weird situation.
I have few correlation searches for which notables are suppose to be generated for SOC monitoring.
On security posture, i have SOC dashboard, whoch displays the searches
| es_notable_events|search timeDiff_type=current | chart count over name by status
here it shows total notables created as new and assigned.
Since sunday this is giving me weird results. It shows some random numbers on the dashboard but when i drill down it gives, "Search did not return any events."
when i run index=notables, i can see all the notables are getting generated however same is not getting in the lookup file "es_notable_events"
can someone help with the troubleshooting steps?
also, i could see the number displayed over security posture and total count i get when drill down are totally different.
Request some expert advise.
