Hi @richa , probably, source isn't the best solution to check ingestion because it usually change, for this reason I used sourcetype, otherwise, you could use index: | tstats
count
latest(_...
See more...
Hi @richa , probably, source isn't the best solution to check ingestion because it usually change, for this reason I used sourcetype, otherwise, you could use index: | tstats
count
latest(_time) AS _time
WHERE
index IN (index1, index2, index3, index4)
earliest=-30d@d
BY index
| eval period=if(_time>now()-86400,"Last 24 hours", "Previous")
| stats
dc(period) AS period_count
values(period) AS period
BY index
| where period_count=1 AND period="Previous"
| table index _time Ciao. Giuseppe