We have data coming in and we are still searching for a best practice on what alerts to monitor, however, my question is on the query below:  index="storage_vmax" sourcetype="dellemc:vmax:rest" type=ARRAY severity = FATAL |search (severity!=NORMAL AND severity!=INFORMATION) | stats count by _time,created_date,source,reporting_level,severity,asset_id,array_id,type, state,description Where I would like to bring in only what was created in the last 24 hours.. The problem with the existing query is that it is bring in created log entries from a year ago which are stale. If we are going to have SNOW open tickets we do not want it to so on stale data only new. Thanks, Dali   ... View more