stroomdev10
stroomdev10
``` from 'My Index' where eventid=1 select EventId, eventid ``` gives lots of `1, NULL`
If you have a Query that you use as the input to a Pipeline (via the Process icon), and you set a Concurrent Task limit on the Processor Filter then...
Is this actually an ERROR, is the administrator required to perform any activity when this is spotted?
Currently you can only view the Filter
Previously Searches that contain an `in dictionary` term would log the contents of the dictionary. This is no longer happening, was it removed for a reason or is it just...
in the same way as we can re-sort with re-query
I have a Rule that uses window, when it fires the generated Detection has two instances of period0 and period1 ``` 101 22 22 101 ```
``` from "blah" eval p0=mask(0,count()) eval p1 = mak(1,count()) window EventTime by 1d select p0,p1 show as LineChart(x=EventTime, y=p0) ``` This query automatically adds the EventTime field, but I can't...