Hi every one
so I want to know detail in my dashboard such as number in circle.
PLS tell me duration time 24 h . if i click investigation i see events around 490 events
thank you.
Hi every one
so I want to know detail in my dashboard such as number in circle.
PLS tell me duration time 24 h . if i click investigation i see events around 490 events
thank you.
My current version is 10.6.2.0
I'm using 10.6.4.x and the issue turned out to be with count/countdistinct between rules and charts.
In the charts, countdistinct has the same effect as count which is wrong and RSA are working for a fix.
If your issue is different, I suggest that you raise it with Support.
Never mind, in my case, Engineering changed their mind about this being a bug. Now they say it's normal behaviour even with the wrong values
After having raised a few cases for issues with dashlets, I now understand that Engineering do not really care or expect that the values in these dashlets are accurate.
If you want to know what events make up those numbers you can click on the pie slice in the chart and investigate that section of data to determine what values are under that number.
I would also encourage you to consider upgrading from 10.6.2 to 10.6.5.X to catch up on security fixes and enhancements in the product (also gets you closer to being on the 11.x code release).
I think they mean that 33+26+22 does not make up 490 events seen in investigation after drilling through the pie chart.
I have a similar problem and CE said that it's expected behaviour
1175858
There is a word doc attached to the case notes with detailed explanation of my findings.
What version are you using? I have also noticed some inconsistencies in dashlets/charts/rules.
In my case, when I test a rule I get different results than if I put that same rule in a dashlet