I noticed in our environment, from many uf, the internal logs were indexed under a different index name. After investigation, I find it's related to some settings in transforms.conf. So in transforms.conf, it's like: [test_windows_index] REGEX =.* DEST_KEY = _MetaData:Index FORMAT = rexall_windows in props.conf, for certain hosts, there're settings like: [host::testserver1] TRANSFORMS-Microsoft_AD_1 = test_windows_index, Routing_testCloud I believe I should try to exclude indexes like "_internal, _audit", so I changed REGEX=.* to  REGEX=[a-zA-Z0-9]+ but it doesn't seem to work. Appreciate if somebody here can help or provide suggestions.   ... View more

I have 2 searches: 1. Search(AAA)|rename _time as TimeA|table TimeA host; 2. Search(BBB)|rename _time as TimeB|table TimeB host How to create a new search: Search(???)|table host; (or Search(???)|table TimeA TimeB host) Which will only list the hosts that TimeB is older(or smaller) than TimeA (there might be more than 1 results TimeA and TimeB for each host, in that case, just pick the latest one to compare) ... View more

I have a search like: sourcetype="AAA"|table _time userid, and I have a table like userid, username, how to make the result as .....|table _time userid username. ... View more

My search string: sourcetype="AAA"|table _time event_iduser Results: 9/10/2015 23:24 303 user1 9/10/2015 21:50 302 user1 9/10/2015 21:50 303 user2 9/10/2015 21:50 302 user2 9/10/2015 11:21 303 user3 9/10/2015 11:18 302 user3 Hope to get results as: sourcetype="AAA" .....|table user Time_302 Time_303 Usern Time_302 Time_303 user1 9/10/2015 21:50 9/10/2015 23:24 user2 9/10/2015 21:50 9/10/2015 21:50 user3 9/10/2015 11:18 9/10/2015 11:21 ... View more