Hi Guys, Thanks for the help. I did some testing last night and I realized that might it might not be the configurations that is causing the problem. Here my infrastructure setup: Indexer is on AWS Search head is a VM instance in my company. Search head is able to telnet to index's IP via 8089. TCPdump on the indexer show the traffic too. However the search head is not able to added the indexer as a search peer. So I went ahead and create another Search head in AWS. This AWS search head have no problem adding the AWS indexer. Not sure what is wrong with the Search head in my company. The search peer is added via https://xxx.xxx.xxx.xxx:8089, using IP so I think DNS resolution is not an issue. The Search head in my company is behind a firewall with NAT outgoing IP. The AWS indexer can only see the NAT IP of my company gateway. Any configurations I need to do? 😞 ... View more

Hey thanks for the recommendation, streamstats really give me the "light bulb" I was thinking this might work: "search"| sort + Serial | streamstats window=2 global=f current=t first(complete) as next_com, first(serial) as next_serial | fields serial, complete, next_serial, next_com | eval test=if(complete > next_com, serial, 0) | fields serial, complete, test | eventstats max(test) as m_test | where complete == 0 | where (serial > m_test) However I do not know is this an efficient search... Comparing to using sub-search, will this be a faster search? ... View more