Hi @novotxms, if this answer solves your need, please accept it for the other people of Community. Ciao and happy splunking. Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Maybe instead of doing a trending search for no data, look into the metadata command to go by hosts, sourcetype, or source.  Then make your alert based off of the hour last seen.  | metadata type=sourcetypes index=google | sort recentTime desc | convert ctime(recentTime) as Recent_Time | eval hours_since = round((now() - recentTime) / 3600,2)   ... View more

Hi @novotxms, You can try sample below; https://docs.splunk.com/Documentation/Splunk/8.1.2/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest  [source::/var/log/messages] TRANSFORMS-set= setnull,setparsing transforms.conf [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = sgt\=4 DEST_KEY = queue FORMAT = indexQueue   ... View more