Discover, the Time Picker and the Histogram
What is it?
Discover is where you explore raw events: a data view, a KQL bar, a time picker, and a histogram of event counts over the selected window. Every search happens inside the chosen time range — nothing outside it is returned.
Why it matters
The time range is the single most common reason a search 'finds nothing'. The evidence is usually just outside the window. The histogram also lets you see when activity spiked before you even filter.
Where you see it
Top-right time picker: 'Last 15 minutes', 'Last 24 hours', or an absolute range. The histogram bars show counts per interval; clicking a bar zooms the range to that spike.
What normal looks like
A time range wide enough to contain the event, and a histogram whose shape matches normal business rhythm — busy in the day, quiet at night.
What suspicious looks like
A histogram spike at an odd hour, or activity that continues flat through the night when humans are gone. But first make sure the empty result is not simply a too-narrow time range.
How analysts investigate
Set a time range you are confident contains the event (widen when unsure), read the histogram for spikes, click a spike to zoom, then apply KQL to narrow to the events that answer the question.
Common beginner mistakes
- Concluding 'nothing happened' when the time picker was set narrower than the incident.
- Ignoring the histogram, which often shows the spike before any filtering.
Every search lives inside the time range
[ KQL: event.outcome:failure ] [ Time: Last 24 hours ▾ ]
histogram (count per hour):
▁▁▂▂▃▃▅▇█ ... ▁▁ ← a spike at 02:00 when the office is empty
click the 02:00 bar → range zooms → Discover lists just those events
empty result? FIRST suspect the time range, not the absence of evidenceQuick check
Your KQL query returns zero documents. What is the FIRST thing to check?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.