OK got it so basically: UF gathers a lines and send to heavy forwarder/indexer Indexer drops all lines except those not matched by the reg ex. I'll give it a whirl! Thanks @PickleRick  and @tscroggins 

How long are you prepared to wait for the service to come up again? Are you looking to alert if all the servers don't come back up within a certain time, or if any one of them doesn't come back up? Are events generated when the service is up, and how regularly do these events occur? Can there be periods when no events are generated but the service is still to be considered up?

Hi @marnall  I tried your suggestion, but the _time always set to info_min_time My search time is this morning:  Mar 11 2024 10:12:00 EDT Time Frame is: last 30 day, so info_min_time (start time: Feb 10 2024 00:00:00 EST) info_max_time (end time: Mar 11 2024 00:00:00 EDT) _time is set to info_min_time as seen below   Can you set your search time to to last 30 day and run the collect command with testmode=true and share your results? | collect index= summary testmode=true addtime=true file=summary_test_1.stash_new name="summary_test_1" marker="report=\"summary_test_1\""   You should have _raw field that contains all the fields, including _time before getting pushed by collect command.   See my below output. Please share yours.. Thanks    

As I understand it, you want the tstats command to look only for process names in the lookup file.  You can do that with a subsearch | tstats `summariesonly` count from datamodel=Endpoint.Processes where [|inputlookup is_windows_system_file" | fields filename | rename filename as "Processes.process_name" | format] by Processes.aid Processes.dest Processes.process_name Processes.process _time  

Hey there @elizabethl_splu  after reading this thread i tried this setting on my splunk 9.1.2 environment and it dosen't work. i opened a file named  web-features.conf with the stanze  [feature:dashboards_csp] enable_dashboards_redirection_restriction=false under /opt/splunk/etc/shcluster/apps/ADMIN_CONF (folder i created to disterbute conf files and updates) and still getting this warning, can you think of anything im doing wrong? thanks in advanced!

Hi @Harish2 , no it's the easiest and flexible way, but why you don't want to use the hours and minutes in the search? you can also create a macro to call instead adding all the conditions to your searches. Ciao. Giuseppe