index=_internal source=*metrics.log group=tcpin_connections | eval sourceHost=if(isnull(hostname), sourceHost,hostname) | dedup sourceHost | table sourceHost sourceIP os version | sort version Thanks for sharing this, but when we use this search string we get duplicates, where forwarders in the results list both hostnames and a duplicate records for each as IP address. So we have two results for each forwarder, one with hostname and another with just the IP. Also, the hostname column does not populate the IP address column. ... View more

Hi Splunker4Life, take this run everywhere example and adapt it to your needs: index=_internal source=*metrics.log earliest=-30min@min latest=-0min@min NOT [ search index=_internal source=*metrics.log earliest=-60min@min latest=-30min@min | dedup series | table series ] | stats count by series this example will search for all series in metrics.log for a time range 60 minutes to 30 minutes ago and use this result to compare with the same search but with a time range 30 minutes to 0 minutes ago. The resulting stats will only show new series events for the last 30 minutes. hope this helps to get you started ... cheers, MuS ... View more