What does the query | makeresults generate?
What does the query | makeresults generate?
The query | makeresults generates a timestamp. It is used to create an event with that timestamp, primarily for testing purposes or creating dummy data. By default, it generates a single event in memory with the _time field.
It generates the specified number of search results in temporary memory. With a single field, _time.
Makeresults generates a timestamp so you can create an event with that timestamp, mainly for purposes (i.e. testing an alert). Generates a single event in memory with only the _time field. You can add event fields using eval. Must be the first command in search succeeding a pipe
| makeresults alone generates "_time" only