How do i filter by observer

[cerberus10748]

Hello,
I have a cluster of about 27 nodes that have similar IPs and data. How can i create a dashboard for searching for one nodes data or filter by observer name?

[dougburks]

If you go to SOC Dashboards, the default dashboard should include a groupby table for observer.name. If you click on a value in that table, you'll get a context menu and you can then choose to include or exclude that particular observer.

If you're looking at another dashboard and it doesn't already have a groupby table for observer.name, then you can easily add this to the end of the query:

| groupby observer.name

For more information, please see the Dashboards section of the documentation:
https://docs.securityonion.net/en/2.4/dashboards.html