0 hits in preview result with custom query

I am trying to create a custom query detection rule in kibana 7.16, the query is as simple as this:

 dstcountry.keyword : "Spain" 

when i click on preview results it returns 0 hits, but in the discover i get almost 10000 hits. what can it be due to?
Thanks in advance.

Are you sure you set up correctly the indices and time field? Just checked (on 8.4.3) and it works as expected.

Peek 2022-10-24 15-54

Have you tried using KQL instead?, it asks for a data view (index pattern) so the time field is already defined for you.

I had misconfigured the rule, thanks anyway.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.