Hi, I am attempting to find the neighbouring events to a particular event over the last months set of data, but I'm only getting a subset of the results I need. My query, without the map command is host=hostname1 OR host=hostname2 NOT source="WinEventLog:Security" searchterm | localize timebefore=30s which correctly returns results spread over the last month - most days there are a number of events logged. When I add the map command as below, I only receive results from today and yesterday. host=hostname1 OR host=hostname2 NOT source="WinEventLog:Security" searchterm | localize timebefore=30s | map search="search host=hostname1 OR host=hostname2 NOT source=WinEventLog:Security earliest=$starttime$ latest=$endtime$" How can I get all of the last months worth of results? Thanks, David ... View more