Is it possible to do a search that returns the last 4 full hours? Meaning, if it is 5:13 PM it would return results between 1:00 PM and 5:00 PM (filters out off the current hour) Thanks in advance for any responses ... View more

Thanks in advance for any help. I'm trying to find the days that a Device has not been patched for Critical Severity vulnerability (currently not patched). The example below should return 3 days for Device Server01.  Tried stats and streamstats but not able to get it to to produce below results Device Message _time Server01 Severity Critical Patch Missing 11/1/2021 2PM Server01 Ok (Fully Patched) 11/2/2021 2PM Server01 Severity Critical Patch Missing 11/3/2021 2PM Server01 Severity Critical Patch Missing 11/3/2021 6PM Server01 Severity Critical Patch Missing 11/4/2021 2PM Server01 Severity Critical Patch Missing 11/5/2021 6PM (latest event) ... View more