Dashboard in app is not showing the expected results

You are using an app, and one of its views does not show you the results you expect. Begin troubleshooting here.

Determine the search string that powers the panel that is not showing the expected results

There are many methods to achieve this.

You can look at the view source by appending "?showsource=1" ("&showsource=1" if other parameters have already been appended) to the view URL in the browser address bar.

Expand macros and event types

Macros and event types are convenient knowledge objects, but unless you know exactly what they do, they can obscure the way a given search works. For that reason, it is often easier to expand them manually so that you know exactly what your search is doing.

You can see the contents of your entire search by using a keyboard shortcut, Command+Shift+E (Mac OSX) or Control+Shift+E (Linux or Windows) from the Search bar in the Search page. This opens a preview that displays the expanded search string, including all search macros and saved searches. For more info, see Expand your search in the Search Manual.

Run the search manually from the time line, in the relevant app context

Answer the question: Can you reproduce this manually, outside of the view it was reported in?

Compare results against source events

The next step is simple: Compare the results generated by the search and its multiple evals against the source events.

Dig deeper

In order to drill down to the source of the problem, pick one example. A good one if possible: A search that we know was run by an actual user.

Add the SID as a search term.

As discussed earlier, stats first(user) by search_id picks up the most recent value of the user field for a given search id.