About dummy data

If you need sample data to check the operation of the search command, you can use the makeresults command to generate sample data without configuring data import settings.

In addition, when using the makeresults command, the data is not indexed, so it can only be used within the actual search.

About the makeresults command

The makeresults command prints to the screen the time the search was performed.

It can be used by performing a search as follows.

| makeresults

*Please write | (pipe command) at the very beginning of the search statement.

It is also possible to create another field by using it with the eval command.

example:

| makeresults | eval user="Taro", ip="1.1.1.1"