as you have to be explicit whit stanza names, you could put all this saved searches into a dedicated app, and the set the ttl in the default stanza [default]  for all searches in this app.   ... View more

This is resource issue, so backfill script is not a solution, rather patch to fix issue created by resource limitation. So, you definetly have to fix the resource issue.   I hope this helps!!! ... View more

I had the same problem, but I wasn't aware of "$trellis.value$"!  It solved my problem. Thanks! ... View more

@Sharzi try this to return records where DB is NOT "unknown"     base_search [ inputlookup myLookup | fields TenantName, tenantId | where tenantId!="Unknown" AND TenantName=TenantName] | lookup myLookup tenantId TenantName output TenantName, tenantId, Region, DB | | table _time TenantName tenantId Region Status DB       updated reply to correct spellings and missing fields ... View more

Perhaps the easiest way is to use strptime/strftime. index=mydata | eval fields=split(EventMsg,",") | eval file_string=mvindex(fields,0) | eval CreatedDate=mvindex(fields,17) | eval Date = strftime(strptime(CreatedDate, "%y%m%d%h%m%s"), "%d/%m/%y %H:%M:%S") ... View more

Hi @richgalloway , We don't have any transaction command in our search query, but as you said, the problem was "latest". I changed the "latest" and now it is working fine! Thanks.   ... View more