Change the search to add in to the user and destination so it's captured, e.g. | tstats summariesonly=t allow_old_summaries=t count values(Authentication.dest) as dest values(Authentication.user) as user from datamodel=Authentication by Authentication.action, Authentication.src | rename Authentication.* as * | chart last(count) values(dest) as dests values(user) as users over src by action i.e. change the first 3 lines to add in the values - not also the wildcard rename You can add more fields from the Authentication datamodel if you need more information ... View more

The query uses a datamodel, which automatically inserts "unknown" in certain fields that have no value.  There's nothing you can do about that other than change the source to provide a proper value. Consider using the datamodel's constraints to fetch the raw events used to detect brute force attacks.  Perhaps something there will provide a clue to the source. ... View more

hi @MalcolmC, The search head must be at the same or a higher level than the search peers (indexers). So you should upgrade the search head first then the indexer.  ... View more