It seem Splunk is not passing all result fields from a base search to a post search. This could be for performance reasons. You can force the base search to pass required fields explicit to the post search by adding a fields statement. In your example: index=mail-security | transaction keepevicted=true icid mid | search policy_direction="inbound" | eval msec_default_threat_reason =coalesce(case(spam_verdict="positive","Spam Detected",av_verdict="positive","Virus Detected",content_filter="content filter","Stopped by Content Filter",invalid_recipient="rejected by SMTP Call-Ahead","Stopped as Invalid Recipients",msec_default_reputationfilter="REJECT SG BLACKLIST","Stopped by Reputation Filtering", vof_verdict="positive","outbreak"),"Clean Messages") | fields field1 field2 field3 ... View more

This should be fixed with the new Check Point TA 4.0.0: https://splunkbase.splunk.com/app/3197/ ... View more

Is the # of concurrent searches on that peer at the time the job was run. Yes, you can use this # to determine the search concurrency at a given point in time on each search peer. It is only one indicator for what is going on your systems. /alex ... View more