Start maybe with the generic query - | metadata type=hosts index=* | eval host=lower(host) | eval _time=recentTime | sort host, _time | stats latest(_time) as recentTime by host | eval LAST=strftime(recentTime,"%a %m/%d/%Y-%T %Z(%z)"), DAYS_AGO=round((recentTime-now())/86400,0) ... View more

thanks xpac. ... View more