I have dashboard with chart inside it.
The query of the chart is:
**base_search | eval _time = time| bucket _time span=24h | chart count over _time by app_risk| fields _time,Critical,High,Medium,Low**
The drill down settings are: On Click=Link to Search & Auto.
When clicking on "High" category on specific date, I would like to see the events related to this combination of risk and date.
For some reason, I have no results after drilling down.
**I see that the date time range is changed form the whole day (24 hours) to 9/16/18 3:00:00.000 AM to 9/16/18 3:00:00.001 AM.**
Can someone tell me why the results are not related to the specific column date?
↧