0 hits in preview result with custom query

Elastic Stack Kibana
1

Hi,
I am trying to create a custom query detection rule in kibana 7.16, the query is as simple as this:

 dstcountry.keyword : "Spain"

when i click on preview results it returns 0 hits, but in the discover i get almost 10000 hits. what can it be due to?
Thanks in advance.

2

Are you sure you set up correctly the indices and time field? Just checked (on 8.4.3) and it works as expected.

Peek 2022-10-24 15-54

Have you tried using KQL instead?, it asks for a data view (index pattern) so the time field is already defined for you.

3

I had misconfigured the rule, thanks anyway.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.