Hi @selvam_sekar, you have some methods to accelerate your search that youcan find described at https://docs.splunk.com/Documentation/Splunk/9.1.2/Knowledge/Aboutsummaryindexing My hint is to use Datamodels or Summary indexes. About the second, you have to schedule your searches with a frequency to defin based on the time for the search execution and your refresh requirements. So you can save the results in a summary index and then run your search on the aggregated values that you have in the summary index. Ciao. Giuseppe

Hi @quangnm21 , after every stats command (also tstats) you have only the fields that are present in the command, so dest_nt_domain and src_nt_domain aren't still present. You have to insert in the tstats command the two fields with the values option: | tstats `security.content.summariesonly` values(host) AS srcHost dc(host) AS chost min(_time) AS firstTime max(_time) AS lastTime values(Authentication.dest_nt_domain) AS dest_nt_domain values(Authentication.src_nt_domain) AS src_nt_domain FROM datamodel=Authentication WHERE Authentication.action="success" Authentication.dest_nt_domain="PTIT" Authentication.src_nt_domain="PTIT" Authentication.user="qmn" BY Authentication.user | eval abc = tostring(dest_nt_domain), xyz = tostring(src_nt_domain)  Then I hint to rename some fields avoiding the dot in the name (sometimes functions don't work). Last doubt: if you have the Authentication.user field in the WHERE condition, why do you have it also in the BY cluse? it's always one value! Last thing: please next time use, in addition to the screenshots, add also the search in text mode (using the "Insert/Edit code sample" button) , so I don't need to rewrite it! Ciao. Giuseppe