Hi,
sory if this question has been asked, but I cant seem to find via google.
I have a basic setup, where I want to filter in visualize section whole IP traffic in numbers form - e.g. how many times 8.8.8.8 has been used goes on top, and if one IP is used one time in month - i want to know about it too. On the left side menu it looks like this:
metrics:
Metric Count
buckets:
Split Rows destIP.keyword: Descending
Split Rows srcIP.keyword: Descending
So when I do search: srcIP: 1.1.1.1
I get results how many times to what destination IP this 1.1.1.1 is bound to. The problem is - I have IPs that dont show up in results, lets say its destination IP 2.2.2.2 . But when i search specifically for that 2.2.2.2 - it does show up, even bound to 1.1.1.1 . Also, results are always only 2 pages for this 1.1.1.1 range. When I search for something else, it can go beyond to even 5 pages or so, so its not a search limit of some kind? Or is it? Thanks for the help.