Hi @ivan123357 , I'd try something like this: index=custom (evt_id=1 OR evt_id=2) earliest=-5m latest=-7m | stats last(evt_id) AS evt_id earliest(_time) AS earliest latest(_time) AS latest BY user_id | where evt_id=1 OR (latest-earliest>300) Ciao. Giuseppe ... View more

I'm not sure how to handle that case, but perhaps someone else will have an idea. ... View more

I tried this way but I didn't receive any result. I am a newbie in Splunk 😞  What do you think about this way?: I can search all events with a successful update using regex search  source="WinEventLog:System" | regex Message = "KB5555555" and for example i receive a few events from two hosts. First question: How I can create a table with a list of these hosts? As I guess, then I can't use a search like "source="WinEventLog:System" | regex not Message = "KB5555555"" to find all hosts without this update because this search won't show any events.   I'm stumped 😞  ... View more