Why overlapping DMI time range would show different results?
Hi guys,
I'm confused about why CAS would return different results for overlapping time range:
For the image above, the time range is 12:30 to 13:00, and we see the user name with requests breakdown. (S8-----3B is the same client as 220.x.x.231, we capture the user name based on a POST body during login and the rest of the operations have no user name parameter and only rely on a SSID)
But when we change to 12:30 to 13:30, we are seeing less results, which doesn't really make sense to me.
Any insight on how CAS returns result based on time range?
Christopher,
Do you have more than 1000 users? If so this report by default brings back the top 1000 records by default, so if you have more than 1000 users when you expanding your time range this user may not be report output list when you use the find in the report. I believe when using the find its just search the results from the top 1000, not going back to the db and searching for those users.
You can either A, edit the report definition on they fly and change the select top items to a higher value then try again. B, when editing the report just put the desired names in the username dimensions. C, if A works and you want to use this workflow, then you can save this report so it always has the higher top results but make sure when you save you remove all the filters in the dimensions besides traffic type real as this is global report where filters from other reports are getting past along to the All User report, then moving forward you will always have higher top results when users are using this workflow.
D, if you want just a user lookup report you can save the All Users report with as different name but before saving chose Dispay form then save, but again as a different name, as this All Users is global report used by OOB reports.
Thanks,
Mike
Hi Michael,
That's the reason! Thanks for clearing that up!
