How to dedub a field in Wazuh query

[Emar Flix]

Hello, 

As you know in Wazuh discovery we can visualize any filed that, and when we do that we can see top 5, 10 etc values (users, IDs so on). I want to know that how can we see all of them, for example I want to know how many source users generate event Id 3, I can only see some of them on visualization.

Thanks.

[Md. Nazmur Sakib]

Hi Emar,

You cannot see more than the top 5 field values when you hover over a field on the left side of the Discover page. This is not possible to change without making changes to the source code.

To see more field values, you can click Visualize at the bottom of the top 5 values.

This will redirect you to the visualization and change the size from the Bucket section to the number you would like to see. Check the example for reference.


For the data you work with regularly, you can create custom dashboards for the top 20 or 50 values so you can access them quickly.

You can follow this document to create a custom dashboard.
https://documentation.wazuh.com/current/user-manual/wazuh-dashboard/creating-custom-dashboards.html


Let me know if you need any further information on this.