From the syntax `Exempted_Dark_Devices`, it's a macro. Look in the macro definitions and you should be able to find the expansion of this macro https://docs.splunk.com/Documentation/Splunk/9.2.0/Knowledge/Definesearchmacros ... View more

Only the fields provided by the metadata command can be displayed unless you add other commands that search indexes for names ending with "srx".  If the desired field *is* returned by metadata then include it in the fields command then use where or search to filter the desired values. | metadata type=hosts | where recentTime < now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen | search host="*srx"   ... View more

How many hosts are typically returned?  If there are not many, you can just use metadata to filter index search.  This would meet your original requirement.   [metadata type=hosts | where recentTime < now() - 10800| stats values(host) as host] | dedup host   If there are too many, performance can be a concern.  (You can also add other filters in addition to | metadata.) As @PickleRick noted, you probably don't want to send raw events, especially not a lot of them, in E-mail.  In theory, you SHOULD have this "somenumber-somename-ks-srx" extracted in a field it means something.  Haven't you?  Assuming the field name is somefield.   [metadata type=hosts | where recentTime < now() - 10800| stats values(host) as host] | dedup host | table host _time somefield     ... View more

Hi here https://docs.splunk.com/Documentation/Splunk/8.2.4/InheritedDeployment/Introduction is excellent guide to get familiar with your environment. Based on it, you should get clear understand what you have. If/when you have a distributed environment there are (as you told) several servers with different roles like search head, indexer(s),  manager node (if there is indexer cluster), heavy forwarders, UF and maybe DS (deployment server), LM (license manager, could be some other server as additional role) and MC (monitoring console). If you have monitor console on place you can use it as getting topology of your environment. When there are separate search head (where you normally log with GUI) and indexer(s) and/or MN then you must add index definitions to indexer peers or if you have indexer cluster then into manager node and then deploy those to peers. r. Ismo ... View more