Hi @Harish2 , the condition you required is that hour must be NOT hour<8 OR hour>11. Are the hours of the events in the results compliant with this condition? maybe you should change the hour condition. Ciao. Giuseppe

I am looking for more of a generic mapping of resources to parts of the pipeline. However, this specific case is regarding a HF. Machine Name Machine CPU Cores (Physical / Virtual) Physical Memory Capacity (MB) Operating System Architecture redacted 16 / 32 131020 Windows x64

Hi @rbakeredfi, are you speaking of an Indexer or an Heavy Forwarder? Have you done a correct assignemt of resources? how many CPUs have you on this server? If you're speaking of an Indexer, have you a performant disk: at least 800 IOPS (better 1200)? Ciao. Giuseppe

@kiran_panchavat... Sorry for the late reply...we tried checking all the steps..peerlogs, license., oom issue...could not find anything wrong and all were good. So we tried a rolling restrat of the SH cluster ...that fixed the issue and errors were gone Thank you for your time on helping with this..

Hi @gcusello  Ok great, if that's the case, I just want to match events that start with "acl_policy_name" so I can transform the sourcetype to something else. All the events start with that so I'm not sure what else I need to add to the REGEX?  Thank you!

Hi @Harish2 , your search isn't correct, there are some syntax errors. | tstats count latest(_time) as _time WHERE index=app-idx host="*abfd*" sourcetype=app-source-logs BY host | appendcols [ | makeresults | eval date=strftime(_time, "%m/%d/%Y") | lookup calendsr.csv date OUTPUT type | eval type=if(isnotnull(type),type,"NotHoliday"] Anyway, not using the hours , you check only a part of the requirementas you described. Ciao. Giuseppe

Hi @allidoiswinboom, please, which sourcetype ha your running this search: index = f5_cs_p_p | regex "^acl_policy_name=\"$" i addition, in the REGEX in transforms.conf, you should escape the quotes: REGEX = ^acl_policy_name=\"$ Ciao. Giuseppe

Hi @gcusello , Thank you so much, you gave me exactly what i want. but i tried but i don't want to add any date or hours in the query i added  them in the csv file and run the below query still i am receiving the alerts. can you please let me know what i am missing. And i want to add time also in the csv file, and link to the query so that during mentioned time and date my alert should not trigger. please help me on that | tstats count latest(_time) as _time WHERE index=app-idx host="*abfd*" sourcetype=app-source-logs BY host |appendcols [|makeresults |eval Today=date=strftime(_time, "%m/%d/%Y") |lookup calendsr.csv date OUTPUT type |eval type=if(isnotnull)(type),type,"NotHoliday"]