Hello! I have a dashboard with several visualization panels. One of these is linked to a search that pulls the Top 10 Source IPs by Log Activity. index="index_name" $token.source.address$
|fields source_address
|stats count by source_address
|table source_address, count
|rename source_address as "Source IP", count as "Count"
|sort -Count
| head 10 The token, $token.source.address$, is set by a text box on the dashboard for the bar visualization below. However, in addition to the correct value being shown, there are often other incorrect values shown as well. There doesn't seem to be a pattern as to why this happens? Does anyone know why this may happen and how to correct it? Thanks!
... View more