No, you don't change the Datamodel definition at all because the tag field is already defined in every CIM datamodel. If you just create the tags like I instructed and export them to global scope so that the CIM ADM searches will see them, then you can just use a search like this: | tstats allow_old_summaries=true sum(All_Email.recipient_count) AS count, dc(All_Email.dest) AS dest_count FROM datamodel=Email.All_Email WHERE (All_Email.src_category!="email_servers" OR All_Email.src_category!=*) AND All_Email.tag="originating" AND NOT All_Email.tag="STOREDRIVER") BY "All_Email.src" ,_time span=1h | drop_dm_object_name("All_Email")`` | xswhere count from recipients_by_src_1h in email is above high OR dest_count from destinations_by_src_1h in email is above high ... View more