I am trying to build an alert off based of a search that shows me only hosts that have not logged the following string in an event within the last 4 hours: "+[CHAIN] RETAIL_LOCATION_CLOSE" NOT ORDER If this string isn't logged by a host, it tells me the operator did not perform an administrative task and I will want these hosts to appear in an alert. I am assuming I need to perform two searches and compare the difference, but I am having a hard time composing the search. So far I have the following, but I am not getting the expected result (which is the host difference between both searches) | set diff [search index=my_index "+[CHAIN] RETAIL_LOCATION_CLOSE" NOT ORDER | table store ] [search index=my_index | table store] The first search is for my string of interest and the second is just a generic search to return all of the hosts in the index who are logging. I'd like to subtract all hosts who appear in the first search from those that appear in the second, and the difference is my list of hosts who need to be followed up with. Any help for a big giant Splunk newb would be very appreciated. ... View more