The Matched Fields/Service shows which service matches your query.
But when you add a subnet (in the host.services.ip field) to your query, the Matched Fields disappear.
host.services: (protocol:"FTP"): works perfect
host.services: (protocol:"FTP" and ip:"9.1.1.1/8"): goes wrong
Do you have any ideas to fix this? Thanks!
+2Hey Eric, this is a known bug that I’ll raise with the team.
For what it’s worth, for your specific query example, host.services.ip will always be the same as host.ip. To see all of the values for either, you could run a report broken down by host.services.ip or host.ip.
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.