I've made a correlation search that appears to be working fine. But in order to create the contributing event in the notable event, when I use a drilldown search - | datamodel Authentication Authentication search | search Authentication.user="$user$", I see some issues,
1- It is not picking the right $user$, just have "unknown" that is not correct
2- When I click on the contributing event link, it opens the seach page but with default time and not the right date/time range the event happened plus of course the query becomes | datamodel Authentication Authentication search | search Authentication.user="unknown" that I want to fix.
Note that, I have
Drill-down earliest offset set as $info_min_time$
Drill-down latest offset set as $info_max_time$
Please advise.
↧