Why does it say there are events but then it says "No results found"?

[frizzoS3]

After running a search, I have the below results:
112,471 events (9/20/17 2:00:00.000 PM to 9/21/17 2:10:07.000 PM

But when I click on the Events tab, I see this: No results found. even though the search is in verbose mode.

How can I review those 112,471 events?

[louismai]

I have the same issue. The search string run in Verbose mode in Search app, but it didn't run in dashboard. s_hostname is seach-time field extraction.
index=cisco_wsa sourcetype="cisco:wsa:w3c" s_hostname="*"| top limit=20 s_hostname

[DavidHourani]

Hi @louismai, run index=cisco_wsa sourcetype="cisco:wsa:w3c" s_hostname="*"first and see if you get any s_hostname. The number of results is simply the number of events that were returned, doesn't mean that they have a valid s_hostname value.

[bdmeyersc]

I'm surprised that no one answered this question since 2017. (I'm going to be asking the same one, phrased a bit differently, if I can't find an answer here)

[DavidHourani]

answer is in the comments ^^ " tstats will not display events , it will display your output in statistics only. "

[somesoni2]

What's your search?

[frizzoS3]

| tstats summariesonly max(_time) as _time,values(All_Traffic.src_category) as src_category,values(All_Traffic.dest_category) as dest_category,count from datamodel=Network_Traffic.All_Traffic by All_Traffic.src,All_Traffic.dest,All_Traffic.transport,All_Traffic.dest_port | drop_dm_object_name("All_Traffic") | is_traffic_prohibited(dest_port) | search (is_prohibited!="false" OR is_secure!="unknown") | fields _time,src,src_category,dest,dest_category,transport,dest_port,is_prohibited,is_secure

[Ash]

What should be modified in the search to display the events in Verbose mode

[harsmarvania57]

tstats will not display events , it will disply your output in statistics only.