Skip to content

[BUG] DQL/KQL queries gives results in Discover but not in csv reports #190

@davidcui1225

Description

@davidcui1225

Describe the bug
@zhongnansu
in the Discover query bar using DQL, if it's not strictly using the uppercase, or double quotes, even tho it gives results on Discover, but reports will be empty.

Example

both
geoip.city_name:"New York" AND geoip.continent_name: "North America"
and
geoip.city_name:New York and geoip.continent_name: North America
give same results on Discover, but the latter generate empty csv report.

Metadata

Metadata

Assignees

Labels

bugSomething isn't workingcsv

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions