I tried the following. It didn't work. Looks like it put all results in one line. I only got the result for one myindex, and not showing myindex in the table. myindex=router | bucket _time span=1h | stats sum(de_count) as event_count by _time,myindex (get hourly event count by _time) | search event_count!=0 | delta _time as mydelta ( get max number of hours without events) | eval number_of_zeros=floor(mydelta/3600.00)-1 | stats max(number_of_zeros) by myindex | rename "max(number_of_zeros)" as maxgap | table myindex maxgap
... View more