The first search works like a charm! I do have one question, do you know of a way to also include the indicator field in the results? Something along where the below search would yield what I'm looking for. I.e. I would not only like to see the information about the email (sender/recipient/subject) but also what specifically flagged the alert (the indicator). |table _time, indicator, sender, recipient, subject ... View more