Hi Guys,
I am not getting any result from the main search bar with the search below. Even though the same query is working in the App search bar.
index=protect "File Status"=unsafe user="*" "File Name"="*" | dedup "DeviceName", SHA256, "File Path", "File Name" | stats count by "Classification", "File Status", "DeviceName", "File Name" | addtotals fieldname=sum | sort -count | head 10
I checked with the below searches too.
index=main "File Status"=unsafe user="*" "File Name"="*" | dedup "DeviceName", SHA256, "File Path", "File Name" | stats count by "Classification", "File Status", "DeviceName", "File Name" | addtotals fieldname=sum | sort -count | head 10
and
index=* "File Status"=unsafe user="*" "File Name"="*" | dedup "DeviceName", SHA256, "File Path", "File Name" | stats count by "Classification", "File Status", "DeviceName", "File Name" | addtotals fieldname=sum | sort -count | head 10
Can someone help me out on this or tell me why the result is not populating?
Have you checked to see if the app permissions or the extracted fields are set to global?
Hi
I have checked that its not global. Its based on app only. How do I change to global as I have not got that option yet. Can you please guide me?