Hi, In our system, to prevent the high resources consumed, we would like to see all searches including "*" and without field. To explain, someone can search like this index=os *tktpfp*. In this search, after index information, there is not field as you can see. We want to obtain all searches written without any fields. Is there any way to see this searches by using an SPL? Can you help me about this? I appreciate your helps and efforts. index=test error* index=test *errror* index=test * Kind Regards. ... View more