0 hits in preview result with custom query

[irivas95]

Hi,
I am trying to create a custom query detection rule in kibana 7.16, the query is as simple as this:

 dstcountry.keyword : "Spain" 

when i click on preview results it returns 0 hits, but in the discover i get almost 10000 hits. what can it be due to?
Thanks in advance.

[jsanz (Jorge Sanz)]

Are you sure you set up correctly the indices and time field? Just checked (on 8.4.3) and it works as expected.

Have you tried using KQL instead?, it asks for a data view (index pattern) so the time field is already defined for you.

[irivas95]

I had misconfigured the rule, thanks anyway.