Hi Team, @DalJeanis  I am trying to achieve below splunk search query to find out all the errors that are causing JVM instability.       for-each host : hosts (list of hosts) for-each jvmerrorevent(event_time, early15minofevent) : jvmerrorevents (search1 will result a table (list of event_time, even_time-15 minutes as early15minofevent)) result+ = list of errors (search2 = search1+select list of errors occurred between early15minofevent and event_time) return result                                  Below query resulting error. Please suggest if any better way to achieve this. Thanks in advance. index="123apigee"  sourcetype="msg_system_log" (host="123") "ERROR JVM OUT OF MEMORY ERROR" | eval customtime= strftime(_time, "%Y-%m-%d %I:%M:%S.%3Q") | eval 15MinEarlyofEvent= strftime(_time - 900, "%Y-%m-%d %I:%M:%S.%3Q") | table 15MinEarlyofEvent,customtime | map search="search index=123apigee sourcetype=msg_system_log host=123 ERROR | _time=strftime($customtime$, "%s")"          Regards, Nandini G ... View more