thank you - this would work as well:  we are now  going the old data fall out of dashboard and be updated with data from the new DUO site.  You can have data ingested from multiple DUO APIs in the dashboard concurrently, so we have visibility from both sites on the same dashboard, but consolidated.  Appreciated!

Yes, that is what I am trying to do, and I obviously have the host, is there a way to extract this out of the event to add to the alert?   Jan 4 13:07:57 HOST 1 2024-01-04T13:07:57.085-05:00 somenumber-somename-ks-srx rpd 2188 JTASK_SIGNAL_INFO [junos@2636.1.1.1.2.133 message-name="INFO Signal Info: Signal Number = " signal-number="1" name=" Consumed Count = " data-1="3"] Thanks for all the help

Yes. But. 1. As this is a metadata search for hosts only, you'd have to search across all your indexes - you have no indication of which index that event is in. 2. It'd be a very ugly and resource intensive search spawning possibly huge number of subsearches. It's a good way to overstress your Splunk environment. That's why the map command is considered a risky command and not enabled for ordinary users by default. But in general I think you're trying to solve a completely different problem here. The issue of finding hosts which stopped reporting was tackled many times already and there are even specific apps for this - like TrackMe - https://splunkbase.splunk.com/app/4621

https://docs.splunk.com/Documentation/Splunk/9.2.0/Admin/TypesofSplunklicenses#Other_types_of_licenses [...] Free license The Free license allows a completely free Splunk Enterprise instance with limited functionality and license usage. The following important points apply to the Free license: The Free license gives access to a limited set of Splunk Enterprise features. The Free license is for a standalone, single-instance installation of Splunk Enterprise only. The Free license cannot be stacked with other licenses. The Free license does not expire. The Free license allows you to index 500 MB of data per day. If you exceed that you will receive a license warning. The Free license prevents searching if there are a number of license warnings. To learn about license warnings and violation, see What happens during a license violation? For a list of features that are disabled in Splunk Free, see About Splunk Free. [...] So while it doesn't impose any limits on commercial vs. non-commercial use, the features that are disabled make it very challenging for production use of any kind. While in some scenarios you could probably get away without scheduled searches, the lack of ability to create users would probably disqualify the free license in all my use cases.

Not in this search. Remember that at each pipe you get only the results from subsequent commands. So if the metadata command gives you just some, well, metadata, you're not having any events. You'd need to either run a very wide search and do stats latest(_raw) by host, which is not a very good idea or either use this one as part of a subsearch to generate time limiting conditions or pass this through map command. Both solutions aren't very pretty.