Hi, I found the answer. The key for me was "index=*" - that clued me in. It was just the indexes that were being searched by default. Settings > Access Controls > Roles > Admin > Indexes searched by default (I added msad, permon and winevents) Once i made the changes, i started seeing my data in my dashboards. ... View more