I have a monitoring search, that we are viewing both as a graph and when drilling in, as the events. When viewing the events, the information is correct, no issue, but when viewing the data as a chart, every once in a while we get an error.
Normally the graphs bars are counting by the Clinet_IP and the number of event it sees, but for some it randomly switches to counting by by the user name (while still saying it's the Client_IP).... For clarification, most user names are either 'unknown' or 'domain\123456' but some are just '123456' and it's those that are causing issues.
I don't want to take out the usernames from the search, as it provides valuable information when the team is drilling into the events, but this error is annoying to deal with.
This is the search we are running:
index="pan_logs"
| search action=blocked NOT "symantec"
| fillnull user value="N/A"
| stats values(http_category) values(dest_name) values(user) as UserName count by client_ip | sort -count | head 100
