I have custom bar charts. "Edit Query" -> event queries and summary is selected. Every bar chart is as expected except 1.
I put signature id of correlation rule as a filter and I want to see how many events happened last week. When I select "summary" in event queries report produces with 1 line "Correlation_Name X times" in bar chart. But I want to see source events and their count in bar chart. Correlation has different source events.
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.