events not showing

[sulaimancds]

| tstats summariesonly=true max(_time) as lastTime, count FROM datamodel=Change BY "All_Changes.action", "All_Changes.result_id", "All_Changes.user", "All_Changes.dest" | rename "All_Changes.*" as * | search result_id = 4732 | convert ctime(lastTime) as lastTime

i am running this command , there is output , but i want to see events and know more details , but events not showing

total number of events Complete 590,046 events

[VatsalJagani]

@sulaimancds - tstats command does not search events, as it is built for performance and not for showing events. Use datamodel command instead or a regular search.

| datamodel Change All_Changes search strict_fields=false

Kindly upvote if you find this answer useful!!!

[sulaimancds]

hi please provide me the full command

[VatsalJagani]

@sulaimancds  - Try this as a full search and run it in "Verbose mode".

| datamodel Change All_Changes search strict_fields=false | search "All_Changes.result_id"=4732

•  This will show the events as you asked.

But if you need events as well as the results then do a regular search in "Verbose mode".

index=* tag=change | stats max(_time) as lastTime, count BY action, result_id, user, dest
| search result_id = 4732 
| convert ctime(lastTime) as lastTime

Kindly accept the answer and upvote if this helps you!!!