https://community.splunk.com/t5/Splunk-Search/Dependency-on-Azure-Services-status/m-p/446759#M177008 <P>sourcetype=syndication Azure Status | eval since=strptime("2019-02-12", "%Y-%m-%d") | eval date=strptime(published_parsed, "%Y-%m-%dT%H:%M:%SZ") | where date &gt; since| table published_parsed, id, title, summary | sort -published_parsed</P> Tue, 29 Sep 2020 23:24:08 GMT dsmuralitharan 2020-09-29T23:24:08Z https://community.splunk.com/t5/Splunk-Search/Dependency-on-Azure-Services-status/m-p/446758#M177007 <P>we need to send out notification when ever a global outage was happening with Azure using the RSS feed, is the any query to get the data from the feed using syndication, pleas help me on this</P> <P>This is my query </P> <P>sourcetype=syndication "Information :" NOT "RESOLVED" <BR /> | eval since=strptime("2016-11-18", "%Y-%m-%d") <BR /> | eval date=strptime(published_parsed, "%Y-%m-%dT%H:%M:%SZ") <BR /> | rex field=summary_detail_base "rss\/(?<AZURE_OBJECT>.*).rss$" <BR /> | where date &gt; since <BR /> | table azure_object, published_parsed, link, title, description <BR /> | sort -published_parsed</AZURE_OBJECT></P> Tue, 29 Sep 2020 23:05:47 GMT https://community.splunk.com/t5/Splunk-Search/Dependency-on-Azure-Services-status/m-p/446758#M177007 dsmuralitharan 2020-09-29T23:05:47Z https://community.splunk.com/t5/Splunk-Search/Dependency-on-Azure-Services-status/m-p/446759#M177008 <P>sourcetype=syndication Azure Status | eval since=strptime("2019-02-12", "%Y-%m-%d") | eval date=strptime(published_parsed, "%Y-%m-%dT%H:%M:%SZ") | where date &gt; since| table published_parsed, id, title, summary | sort -published_parsed</P> Tue, 29 Sep 2020 23:24:08 GMT https://community.splunk.com/t5/Splunk-Search/Dependency-on-Azure-Services-status/m-p/446759#M177008 dsmuralitharan 2020-09-29T23:24:08Z