Sentinel User Discussions

Home

Sentinel parsed attribute not list all items

wencheng 7 months ago

Sentinel Version:8.6.1.0.6104

Scenario:

My senitnel upgrade to latest version and collect some event.

I find I simple run Sev:0 To 5 , the default list seem not list all items in 1 hour...

because I know I have windows event and IIS event...but the list not list item.like below:

But then I manual type....the windows event will show up ...the productname show correct (but the privious screenshot does not list windows item)

IIS event has the same issue.

Is it the sentinel 8.6.1.0's known issue ??

Thanks!!

Wencheng

Tags:

item

list

Suggested Answer

0 Norbert Klasen 7 months ago

You have over a million in the last hour. The field count in the refinement panel are calculated over the first 50.000 events. Likely those do not contain any Windows events.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel
0 wencheng 7 months ago in reply to Norbert Klasen

grateful
I think I might have to revise my own concept
I used to think that for one million pieces of data... the system had pre-organized and prepared the first 50,000 pieces of data to be displayed... but the relevant fields were sorted into field categories for these one million pieces of data...

Wencheng
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Resources

Learning Services

Partner Programs

Privacy

Compliance

Help

Company

Privacy Policy
Terms of Use
Cookies Preferences

Accessibility
Anti-Slavery Statement

Support
Contact Us

Careers
Code of Business Conduct and Ethics

The opinions expressed above are the personal opinions of the authors, not of OpenText. By using this site, you accept the Terms of Use. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.), Hewlett Packard Enterprise Company, or Micro Focus. As of January 31, 2023, the Material is now offered by OpenText, a separately owned and operated company. Any reference to the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks is historical in nature and the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks are the property of their respective owners.