i'm creating a dashboard with some general infos, showed as first dashboard to the user.
I have two distinct hiddensearch modules, both of them with this "search" param:
" | eventcount | stats sum(count) as count"
The second module has "earliest" param too, set to -w, to find just the events of the last week.
However, I retrieve always the same result for both research. I check the data, and I should have very different results.
thanks in advance for your answers!
edit: now I'm using this query:
search earliest=-w | stats count
there is a better (and more efficient) way to get the same result?