Hello everyone! We have a log file contains the following information, status 0 means server is up, 1 means down: Date/time Server Status 2019/02/11 120000 server1 1 2019/02/11 120000 server2 0 2019/02/11 123000 server1 0 This file contains many servers' status generated by a cron job. I want to write a Splunk query/search to show all servers which were down and for how long. My desire output would be similar to the following Server From To Duration server1 2019/02/11 120000 2019/02/11 123000 30 Thus I would find a server status is "1", then need to find the immediate status "0" for the same server to calculate the outage time. How do I write this search query? Since a server could be down for a long period, this log file could have multiple entries for same server continuously, such as 2019/02/11 120000 server1 1 2019/02/11 120000 server2 0 2019/02/11 120300 server1 1 2019/02/11 120300 server2 0 2019/02/11 130000 server1 0 Any help is appreciated! ... View more