Hello GCusello, yes I clicked on the word(s) "Blocked" and "Started" in the "Action" field window.  When I use the query index=security action="*" all three actions: Blocked, Started and  Success appear as shown in my original question. If I click on "Success" all of my events are returned, when I click on the other two, my results are "No results found".   I went down the list of Interesting Fields and tried all of the fields labeled with an    (not sure how to type that one) instead of an octothorp (#) and every one of them worked properly.  When I say I tried, I mean I opened the Interesting Fields and clicked on the desired selection, which alters the search criteria, the same way I have done with Blocked and Started.     I do not know how the categories get created in the Interesting Fields but it appears there is something wrong with Blocked and Started. 
						
					
					... View more