On the guided exercise where you make the data table, I can get the first bucket to work. but when I add additional buckets like the directions say, it then says no results found. I have tried a few times. and I’m pretty sure I’m following the directions exactly. It’s just not working.
Any hints?
Hey there - I just tested the lab, but it seemed to be working correctly. Here’s where I was at the end of Part 3, Step 16.
If you’re not getting any data, I would double-check to confirm that you successfully connected the Windows server to the SIEM back in Getting Started, and that you’re using the correct source index in Parts 2/3.
I will start from scratch and double check this.
I appreciate your help 
it worked!!! Yay! Thank you so much!
