Here's what I did, I duplicated whatever field extractions I had in my props.conf file. E.g.; Props.conf before duplication. [oldsourcetype] (?P<somefieldextraction>.*?) Props.conf after duplication. [oldsourcetype] (?P<somefieldextraction>.*?) [newsourcetype] (?P<somefieldextraction>.*?) This way, the old indexed data will still have the field extractions and I can search for the fields from both old and new sourcetype. After doing this, I edited my inputs.conf to include sourcetype = newsourcetype on my monitors so that they use the new sourcetype. ... View more

Here's what I did. I took part of the two answers on this question and came up with the solution. mysearch | transaction devicename maxspan=5m | eval transaction_period=strftime(_time,"%H%M") | eval nighttime=if(transaction_period>=1800 OR transaction_period<=0830, "After Office Hours", "") | eval attemptcount=if(eventcount>1, "Multiple Attempts", "") | eval srccount=if(mvcount(srcip)>1, "Multiple Sources", "") | eval hits=nighttime . "," . attemptcount . "," . srccount | eval hits=split(hits, ",") Explanation; Line 3 takes the hours and minutes from the time. Line 4 checks if the 24hour time is between 1800 and 0830. If it is, output will be After Office Hours else, it will be blank. Line 5 checks if the count within the 5 minutes of transactions is more than 1, if it is, output will be Multiple Attempts else, it will be blank. Line 6 checks if there are multiple source IPs in the transaction. If there is, output will be Multiple Sources else, it will be blank. Line 7 combines all the outputs into a single field so that I can show it in one field. If used without Line 8, it will show as After Office Hours,Multiple Attempts, Multiple Sources if all hits are fulfilled. Line 8 splits by using "," as a delimiter so, the output will be on separate lines as such; After Office Hours Multiple Attempts Multiple Sources If you are wondering why I'm using "" instead of null() , it's because if I use null() , when I combine the fields, it will show nothing even if only one of the field is null() . ... View more