So I am taking the User (Fundamentals 1) and doing the scenario's on page 103. This is on my local machine and is for testing purposes. Without the _wcookie in the sourcetype I was getting no results. After adding it I was able to finish pg.105. On the following when indexing security. I got no results. I had to use index=main. Also in the the dedup. This is the only thing that would work; index=main sourcetype="vendor_sales/vendor_sales" vendorid=*. But could not get table to work.
I am beginning to think I am missing something somewhere? Should I be using the cloud for the Fundamentals 1& 2? I want to pass mu User certification .
... View more