Hi @av_ ! There's a tool some of us use to provide a gut-check, crontab guru (not affiliated in any way with it - just a user),  which I used on the cron you provided: https://crontab.guru/#*/5_21-23,0-13_*_*_0-5 The tool's assessment, is the cron runs on Sundays. If we breakdown the cron, the last part (0-5) sets the days of the week. So it we try changing that to 1-5, it appears it may work for you. */5 21-23,0-13 * * 1-5 There are other tools out there. There's nothing magical about what I used, but I like it for people who are unfamiliar with cron. Good luck! If this helped you, please provide it a thumbs up.

Hi @Dustem, you schedule your search every day (using the last day as time frame) and you save the results in a summary index, one event every day. Then you can schedule a search on the summary index, using three days as time frame. Ciao. Giuseppe

Hi @AL3Z, for forwarders, you should have a list of all the UFs to monitor in a lookup calleg e.g. perimeter.csv, containing at least one field (host). Then you can run a search like the following: | tstats count WHERE index=_internal BY host | eval host=lower(host) | append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ] | stats sum(count) AS total BY host | where total=0 in this way you have the list of UFs not sending logs. If you want a table with all hosts with their status, you could run something like this: | tstats count WHERE index=_internal BY host | eval host=lower(host) | append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ] | stats sum(count) AS total BY host | eval status=if(total=0,"Missing","Present) Ciao. Giuseppe

Hi @merc14, probably you're meaning that you could have events without the productType, obviously these events aren't matched by the All (*) value. You could modify the input adding an additiona static value to search the events without productType. If you could share the input code, I can be more detailed. Ciao. Giuseppe

Hi @AL3Z, are youskeaking of Splunk Enterprise or Splunk Universal Forwarder? if SE, you can try to access the interface or check if the Splunk process is active. if UF, you can see in Splunk if you have internal logs (index=_internal host=<your_host>), or check if the Splunk process is active. Ciao. Giuseppe

Hi @Dustem, you could save the results of you search in a summary index (using the collect command), then execute the alert on the summary index and trigger it if you have more than 3 results. Ciao. Giuseppe