Event vs Statistics Tab
If you perform a normal search, the event tab list all the events that are matched with the search query that you have specified. The statistics tab will not display any reporting data since you did not used any reporting commands.
Reporting commands are commands that creates a table: Commands such as stats count
, table
, or chart
.
Reporting (transforming) command
As long as you don't use any transforming commands your results will always be in the Event tab. If you use any transforming command then the data be transformed to numerical values and ordered the results into a data table, which is why your result will show up in the Statistics tab.
Transforming commands are required if you need visualization.
No Comments