I was able to make the search below work so that when the event that triggered the alert ran, it would gather the last 5 events prior to the alert event within the same index & source specified. <Root_Search> | head 1 | eval marke=_time+1, marks=marke-60 | map search="search <Root_Search> starttimeu=$marks$ endtimeu=$marke$ | head <number_of_events_to_go_back> | reverse" EXAMPLE: index=_internal source=*splunkd.log* component=SearchScheduler | head 1 | eval marke=_time+1, marks=marke-60 | map search="search index=_internal source=*splunkd.log* starttimeu=$marks$ endtimeu=$marke$ | head 6 | reverse This will pull the last time splunk had seen an event from search:index=_internal source=splunkd.log component=SearchScheduler along with the last 5 events prior within "index=_internal source=splunkd.log" ... View more