Hi again, I found few logical problems with the #2 query, so I created a data model and I need to use with tstats : | tstats count from datamodel=datamodel_name where `ensure_model_activity` [| inputlookup host-dc5prod where hostGuid=".*" | eval host=hostName."*" | return 10 host] by Datamodelfiled.workspaceGuid summariesonly=f allow_old_summaries=t | rename Datamodelfiled.* as * | lookup workspace workspaceGuid output name as workspaceName currentCustomerGuid as customerGuid | lookup customer customerGuid output name as customerName | table customerName customerGuid workspaceName workspaceGuid | fillnull value="Not Found" I tried to run it with the same append you created but maybe it works differently with tstats : index=indexname environment=prod | rex "Certificates for server agent will expire in (?<expiry>\d+) days" | stats latest(expiry) AS "Days until expire" BY host environment | sort 0 "Days until expire" | eval host=rtrim(host, "prod.net") | eval host=(host."-prod") |lookup host hostName as host Output hostGuid |table host hostGuid "Days until expire"| eval from="events" | append [ | tstats count from datamodel=datamodelname where `ensure_model_activity` [| inputlookup host where hostGuid=".*" | eval host=hostName."*" | return 10 host] by datamodelfiled.workspaceGuid summariesonly=f allow_old_summaries=t | rename submissions.* as * | lookup workspace workspaceGuid output name as workspaceName currentCustomerGuid as customerGuid | lookup customer customerGuid output name as customerName | table customerName customerGuid workspaceName workspaceGuid | fillnull value="Not Found" | stats count by host hostGuid customerName customerGuid workspaceName workspaceGuid | fields - count | rename hostName as host | eval from="lookup" ] | stats values(customerName) as customerName values("Days until expire") as days values(from) as from by host hostGuid | where mvcount(from)=2 | fields - from do you know what I did wrong here?
... View more
