I'm going to talk to myself,  What is the mechanism that normalizes risk_objects in the risk index/data model?  https://docs.splunk.com/Documentation/ES/7.0.2/Admin/Manageassetsandidentities is there supposed to be an alias? I heard rumors of a risk_object_asset field, but I don't know how to create it. should I just coalesce(hostname,ip,email,userid)? ... View more

I added the following to the end of the drill down and made sure the time range was at least the same as the notable run time: | eval drilldown_latest=_time + 3600 | eval drilldown_earliest=_time - 90000 you also need to make sure you have no mv fields  ... View more

This guy Splunks ... View more