How quickly are your events getting indexed? For example, if you look at the _indextime field and compare it to the _time field you will notice a lag. If this is over a minute, it could be that the events between -2m and -1m are not indexed before -1m and would therefore not show up in your alert search

To get you started here's a number of links for you read and work through In short you need the nix TA, UF and configure inputs and outputs based on your requirements. #This shows you the TA Required (Nix TA) https://splunkbase.splunk.com/app/833 #This shows you the OS Supported = MacOs is listed https://docs.splunk.com/Documentation/AddOns/latest/UnixLinux/About   #Read the release notes https://docs.splunk.com/Documentation/AddOns/released/UnixLinux/Releasenotes And you will need to install a Universal Forwarder for the MacOS + configure outputs and TA inputs https://www.splunk.com/en_us/download/universal-forwarder.html

I am not sure why you are getting different results in Fast and Verbose mode, but there appear to be some oddities with your search: | eval newtime=strftime(_time,"%m/%d/%y %H:%M:%S") This creates a string - what is the maximum of a string? | stats ... max(newtime) as "event time" Field times does not exist (after previous stats command) | eval times=mvindex(times, 0, 2) I am not sure whether these make a difference though

That is puzzling. If I understand correctly, you're talking about the host_regex setting of the monitor input, right? The docs don't say that there is any kind of escaping required. If it is however, it would be great if you posted a docs feedback (there is a form at the bottom of https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf ) describing your situation and how it differs from the described state.

I cannot understand why you say you are not getting a "table".  Using the lookup sample you gave and the two code samples @bowesmana gave, these are results from my instance 1. Transpose alone 2. Transpose + foreach Both are just like table.  Are they not?

It works, I have an IP list based on the specified system name (prod etc). Now how can I associate this list with a search? So that the list of IPs displayed by this query can be attached to dscip | search sourcetype="new" DstIP=(list of above ip)

If I understand your question correctly, you want group matching messages to be displayed as a single string like “file put successfully”, not separately as "Inbound file processed successfully GL1025pcardBCAXX8595143691007",  "File put Succesfully GL1025pcardBCAXX8595143691007", and so on.  This is a common requirement.  But in addition to unnecessary asterisks in regex's as @ITWhisperer points out, you should group them before performing stats.  Here is the code   | eval message = if(match(message, "File put Succesfully|Successfully created file data|Archive file processed successfully|Summary of all Batch|processed successfully for file name|ISG successful Call|Inbound file processed successfully|ISG successful Call"), "file put successfully", message) | stats values(message) as message   Suppose you have events with the following values of message: message Inbound file processed successfully GL1025pcardBCAXX8595143691007 Inbound file processed successfully GL1025pcardBCAXX8595144691006 Inbound file processed successfully GL1025pcardBCAXX8732024191001 Inbound file processed successfully GL1025transBCAXX8277966711002 File put Succesfully GL1025pcardBCAXX8595143691007 File put Succesfully GL1025pcardBCAXX8595144691006 File put Succesfully GL1025pcardBCAXX8732024191001 File put Succesfully GL1025transBCAXX8277966711002 some unmatching value some other unmatching value The result will be message file put successfully some other unmatching value some unmatching value Is this what you are looking for? Here is an emulation that you can play with and compare with real data   | makeresults | eval message = mvappend("Inbound file processed successfully GL1025pcardBCAXX8595143691007", "Inbound file processed successfully GL1025pcardBCAXX8595144691006", "Inbound file processed successfully GL1025pcardBCAXX8732024191001", "Inbound file processed successfully GL1025transBCAXX8277966711002", "File put Succesfully GL1025pcardBCAXX8595143691007", "File put Succesfully GL1025pcardBCAXX8595144691006", "File put Succesfully GL1025pcardBCAXX8732024191001", "File put Succesfully GL1025transBCAXX8277966711002", "some unmatching value", "some other unmatching value") | mvexpand message ``` data emulation above ```