You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: explore-analyze/alerts-cases/cases/cases-as-data.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -27,7 +27,7 @@ You also do not need to manually manage the analytics indices' index lifecycle m
27
27
After you create cases, {{es}} may take up to 10 minutes to index the new case data. If you create a new space, it can take up to an hour for new case analytics indices to form.
28
28
::::
29
29
30
-
## Explore case data [understand-case-analytics-indices]
30
+
## Explore case data [explore-case-data]
31
31
32
32
::::{admonition} Requirements
33
33
@@ -38,7 +38,7 @@ After you create cases, {{es}} may take up to 10 minutes to index the new case d
38
38
39
39
To explore case data:
40
40
41
-
1. Create a [data view](/explore-analyze/find-and-organize/data-views.md) that uses any of the [case analytics indices](/explore-analyze/alerts-cases/cases/cases-as-data.md#case-analytics-indices).
41
+
1. Create a [data view](/explore-analyze/find-and-organize/data-views.md) that uses any of the [case analytics indices](/explore-analyze/alerts-cases/cases/cases-as-data.md#case-analytics-indices-names).
42
42
2. Search and filter the case data in [Discover](../../discover.md) or build visualizations for dashboards in [Lens](../../visualize/lens.md).
43
43
44
44
To help you start visualizing your case data, here are some sample {{esql}} queries that you can run from the [{{esql}} editor](../../../explore-analyze/query-filter/languages/esql-kibana.md#esql-kibana-get-started) in Discover.
@@ -73,7 +73,7 @@ To help you start visualizing your case data, here are some sample {{esql}} quer
73
73
FROM .internal.cases.default-securitysolution | STATS average_time_to_close = AVG(time_to_resolve)
74
74
```
75
75
76
-
## Case analytics indices names and aliases
76
+
## Case analytics indices names and aliases[case-analytics-indices-names]
77
77
78
78
This section provides the names and aliases of the case analytics indices that {{es}} creates per space and solution. Note that `<space-name>` is a placeholder for the name of a space.
79
79
@@ -112,7 +112,7 @@ These indices store data related to attachments in Stack Management, {{observabi
0 commit comments