https://community.splunk.com/t5/Alerting/Webproxy-search-help/m-p/528034#M9938 <P>Hi I've got this webproxy ES base search where I'm trying to show high number of destinations from a low number of sources. I would also like to&nbsp;<SPAN>throttle the search by going back 24hr, then only looking at the most recent time. How best to do that?</SPAN><BR /><BR /></P><PRE>| tstats `summariesonly` count min(_time) as first_seen max(_time) as last_seen values(Web.action) as Web.action from datamodel=Web.Web WHERE index=webproxy Web.action=allowed by Web.src Web.dest | `drop_dm_object_name(<SPAN class="code-quote">"Web"</SPAN>)` | convert ctime(*_seen) | lookup dnslookup clientip AS dest OUTPUT clienthost AS dest_host | lookup dnslookup clientip AS src OUTPUT clienthost AS src_host | search NOT src_host=drekar-rancher-ccena* | sort - count</PRE><P>&nbsp;</P> Thu, 05 Nov 2020 16:09:54 GMT fdevera 2020-11-05T16:09:54Z https://community.splunk.com/t5/Alerting/Webproxy-search-help/m-p/528034#M9938 <P>Hi I've got this webproxy ES base search where I'm trying to show high number of destinations from a low number of sources. I would also like to&nbsp;<SPAN>throttle the search by going back 24hr, then only looking at the most recent time. How best to do that?</SPAN><BR /><BR /></P><PRE>| tstats `summariesonly` count min(_time) as first_seen max(_time) as last_seen values(Web.action) as Web.action from datamodel=Web.Web WHERE index=webproxy Web.action=allowed by Web.src Web.dest | `drop_dm_object_name(<SPAN class="code-quote">"Web"</SPAN>)` | convert ctime(*_seen) | lookup dnslookup clientip AS dest OUTPUT clienthost AS dest_host | lookup dnslookup clientip AS src OUTPUT clienthost AS src_host | search NOT src_host=drekar-rancher-ccena* | sort - count</PRE><P>&nbsp;</P> Thu, 05 Nov 2020 16:09:54 GMT https://community.splunk.com/t5/Alerting/Webproxy-search-help/m-p/528034#M9938 fdevera 2020-11-05T16:09:54Z https://community.splunk.com/t5/Alerting/Webproxy-search-help/m-p/528164#M9939 <P>Bump</P> Thu, 05 Nov 2020 16:10:05 GMT https://community.splunk.com/t5/Alerting/Webproxy-search-help/m-p/528164#M9939 fdevera 2020-11-05T16:10:05Z