There are two environments, INT and PROD. The value of IREFFECTIVEDATE in INT is always the same, as is PROD, however they have different values. I want to know when the value of IREFFECTIVEDATE in its environment changes. Here is a log sample: 2022-03-04 14:13:00.006, IREFFECTIVEDATE="2016-07-01 00:00:00.0", IRLOANRATE="5" So far my search is this: index= xy sourcetype=xy | eval env = if(host=="prod1", "PROD", "INT") | table IREFFECTIVEDATE IRLOANRATE env | head 1 | eval single_value="IREFFECTIVEDATE : ".IREFFECTIVEDATE." | IRLOANRATE : ".IRLOANRATE." | Environment : ".env" | fields single_value | sort 0 _time | streamstats current=f last(IREFFECTIVEDATE) as priorDate last(_time) as priorTime by env | where NOT (IREFFECTIVEDATE=priorDate) | mvcombine single_value delim=" " | nomv single_value Streamstats recognizes the changing value but it needs to be split by env. Any ideas please? ... View more

When I create an ITSM alert and use $result.Activity$ the correct value for the "Activity" field appears in ITSM.  How do I represent a field called "Start Time UTC{}"?  ... View more

Using Windows EventCodes I want to find 3 or more users failing to log in. So far my syntax is  | stats values(user) as user count by host which looks good. Now I only want to see > 2 users from the same host. | where count > 2 counts the total, not the different values in the "user" field.    ... View more