You can avoid returning an error by using fillnull to populate the field with an empty string: index=*sourcetype=* "Invalid" | rex field=_raw ".*for\sinvalid\s(?<id>.*?(?=:))" | table id | fillnull value="" id | map maxsearches=5 search="dbxquery query=\"select id, name,cell,email, date from idx where id='$id$'\" connection=sql" ... View more

Hi, You need to modify the search on which your alert is based.` your search| eval x=substr(strftime(_time,"%Y-%m-%d %H"),12,2)|eval count=if(x<8,0,count) Now, all counts less than 8 will return 0 , assuming your alert condition is based on the count value , it will take all values for times below 8 AM as 0 but work for all values greater than equal to 8. BTW your alert condition in count <500 or count >500? ... View more

Change your stats to include min(_time) or earliest(_time) . The latter is faster, but the former is going to be correct if you indexed things out of chronological order. For example, sourcetype=priorityEvents | rex field=_raw "User\sID\s(?<user_id>.\d{0,8}+)" | stats count as count, earliest(_time) as date_firstoccurance by user_id | where count > 1 Note, if your timestamps are not in the date format you want, then you will need to add another eval to get the field date_firstoccurance in the correct format. | eval date_firstoccurance = strftime(earliest, "%m/%d/%Y") So your full query might be sourcetype=priorityEvents | rex field=_raw "User\sID\s(?<user_id>.\d{0,8}+)" | stats count as count, earliest(_time) as earliest by user_id | where count > 1 | eval date_firstoccurance = strftime(earliest, "%m/%d/%Y") | table date_firstoccurance user_id count ... View more