A Couple of changes from your last image. Notice the change in evaluating time variables. now(), strptime instead of strftime: You could also remove the eval = aHostMatch... code if you are filtering the hosts in the initial TSTATS. | tstats count where index=cts-dcpsa-app sourcetype=app:dcpsa host_ip IN (xx.xx.xxx.xxx, xx.xx.xxx.xxx) by host | eval currTime = now() ```<- I was not getting a value when using _time with TSTATS ? ``` | eval excluded_start_time=strptime("2024-03-16 18:25:00", "%Y-%m-%d %H:%M") | eval excluded_stop_time=strptime("2024-03-16 18:30:00", "%Y-%m-%d %H:%M") | eval is_maintenance_window=if(currTime >= excluded_start_time AND currTime <= excluded_stop_time,1,0) | eval aHostMatch = case( match(host,"HOSTNAME1"),1, ```<- Case Sensitive``` match(host,"HOSTNAME2"),1, ```<- Case Sensitive``` true(),0) ```| where count == 0 AND is_maintenance_window == 1 AND aHostMatch ==1``` | table host count excluded_start_time, currTime, excluded_stop_time, is_maintenance_window, aHostMatch Also, if a host is not reporting data (down) you will not have a row returned from your initial query and no row for that host for when you check ( where a count == 0 ) TSTATS does not support multiple timeframes... Another approach is to not use tstats and use a stats count First query: (earliest=-30m@m latest=-15m@m) to count historical entries, then a second query to get current entries (earliest=-14m@m latest=-1m@m), then compare historical counts and current counts by host index=cts-dcpsa-app host=HOSTNAME1 OR host=HOSTNAME2 earliest=-30m@m latest=-15m@m | stats count AS aHistCount by host | appendcols [ search index = cts-dcpsa-app host=HOSTNAME1 OR host=HOSTNAME2 earliest=-14m@m latest=-1m@m | stats count AS aCurrCount by host | table host, aCurrCount ] | table host, aHistCount, aCurrCount
... View more