Hi Karlit0, you have to define a perimeter of your ingestion, in other words a lookup containing the list of the sources or the hosts that you're waiting for. In few words, if you need to check if all your hosts are sending logs, you have to create a lookup called e.g. Perimeter.csv, in which there's at least the host column. Then you have to run a search like the following: index=_internal | host=upper(host) | stats count BY host | append [ | inputlookup Perimeter.csv | eval host=upper(host), count=0 | fields host count ] | stats sum(count) AS Total BY host In this way all the hosts where Total = 0 are missing, instead host where Total > 0 are present. You can use this approach also to check othes things as sources or sourcetypes. Bye. Giuseppe ... View more