There are couple of other ways to do that.  I like the dedup command because it's simple.  It retains the most recent n events by the specified field(s). index = index1 | dedup 10 host  This method is for those who dislike dedup.  It counts events by host and then takes those with a count <=10. index = index1 | streamstats count by host | where count <= 10 | fields - count ... View more

Here is one of perhaps many ways to do that.  It extracts the first letter of ROW1 as the new ROW1 value and the adds the ROWcount values with matching ROW1 values. | rex field=ROW1 "(?<ROW1>.)" | stats sum(ROWcount) as ROWcount by ROW1 ... View more

Here's a method that often works.  Search for Start and Completed events, keeping only the most recent for each host and job.  Then discard all of the Completed events.  What's left will be a list of uncompleted jobs. This approach will fail if the Start and Complete events are at the exact time and in the wrong order. index=anIndex sourcetype=aSourcetype (aJob1 OR aJob2 OR aJob3) AND ("START of script" OR "COMPLETED OK" OR "ABORTED, exiting with status" ) | dedup host aJobName | search "START of script" | rex field=_raw "Batch::(?<aJobName>[^\s]*)" | sort _time | eval aDay = strftime(_time, "%a. %b. %e, %Y") | eval aStartTime=strftime(_time, "%H:%M:%S %p") | eval aDuration=tostring((now()-_time), "duration") | eval aEndTime = "--- Running ---" | table aHostName aDay aJobName aStartTime aEndTime aDuration ... View more