Hunt Groupby Unexpected Behavior

[chris-ci]

Good morning,

I am running into an issue when using the Hunt option where my initial query is

winlog.task: "Network Policy Server" AND NOT winlog.event_data.NASPortType: "Wireless - IEEE 802.11" | groupby event.module

I get results in the table below, I then expand a record and click on the field event.outcome add to groupby as seen below and all the records disapear. My question is how do I determine why this is occuring? If I remove the groupby the data comes back.

winlog.task: "Network Policy Server" AND NOT winlog.event_data.NASPortType: "Wireless - IEEE 802.11" | groupby event.module event.outcome

[jertel]

It may be related to this issue: Possibly related: #1824

You can confirm this by manually adjusting the absolute time range to include 1h into the future.

[chris-ci]

@jertel I just tried using an absolute time range like suggested and I'm still observing the same behavior.

[dougburks]

Go to Kibana, find the log, and drill into it. Does the event.outcome field have a yellow triangle?

[chris-ci]

@dougburks I found the records and don't have any yellow trianges so I assume that elastic knows how to index the fields.

[dougburks]

In Hunt, what happens if you manually change the groupby to event.outcome.keyword?

[chris-ci]

@dougburks it does grouping as expected when adding event.outcome.keyword

[dougburks]

I've created the following issue for this:
#2001