Can someone help me optimize this search so the results on the search and dashboard panel should be the same. The search powers the dashboard, but when the search is run the result is always different from the dashboard "| inputlookup workstation* where hostname!="*.corp" (dv_install_status IN ("In use", "In stock") OR ds="dal" OR (seen_by_obt="n/a" AND ds!="dal")) AND (seen_by_cs="Yes" OR seen_by_q="Yes" OR seen_by_sccm_status="Yes") AND (os="Windows" OR os="WINDOWS") | eventstats count as scope_count | join type=inner nt_host [ | search index="maj_p" OnboardingStatus=Onboarded OSPlatform=windows1* | stats latest(OnboardingStatus) as OnboardingStatus, latest(SensorHealthState) as SensorHealthState, latest(OSPlatform) as OSPlatform, latest(ClientVersion) as ClientVersion, latest(_time) as Def_Lastseen by DeviceName | eval Week_breakdown=case(Def_Lastseen>=relative_time(now(), "-7d@d"), "1-7 days", Def_Lastseen>=relative_time(now(), "-15d@d") AND Def_Lastseen<relative_time(now(), "-7d"), "8-15 days") | eval nt_host=upper(replace(DeviceName, "\..*$", ""))] | search OnboardingStatus=* | stats count as agent_count by scope_count | eval missing_agents = scope_count - agent_count | eval incompleteness = round((missing_agents/scope_count) * 100, 2) | eval completeness = round((agent_count/scope_count) * 100, 2)"
... View more
