Hi ,

I have a question regarding the following screenshot below

https://i.imgur.com/0aBjNjS.png

Data Files Searched shows 0(0 B Total)

Index File Count 950 (5.1 GB)

Duration 15 seconds , logs from SEP ( Search for 7 days)

Does data files searched returning 0 mean qradar did not manage to find anything in the SEP logs matching the query or does this mean qradar failed to search SEP logs at all in the first place?

What does index file count mean ? ( The size of SEP logs avail for the search time range?)

Current Qradar Version :7.4.2 FixPack 2 (Build 20210120225428)

Thank You for all the help!

Thank you for this submission into the Support forums for QRadar. We request verification that assistance is still required with your question/comment. If so, please renew your post using the “Ask a question” button above and it will be properly routed for a response.