Glad to help! ... View more

Try something like this index=* sourcetype=maillogs (earliest=-30d@d latest=-5d@d) OR (earliest=-24h) | eventstats earliest(_time) as earliest_time latest(_time) as latest_time by sender | where earliest_time < relative_time(now(),"-24h") AND latest_time >= relative_time(now(),"-24h") ... View more

Hmmm ok, that just makes sense 🙂 I thought there is something more behind this 😄 ... View more

BTW. If you look at this website -theirs syntax with lookup and list that they attached in a link - this syntax just cannot work. I tested in my lab and it does not work. But you helped me to understand that last 'song' must be 'Song' 🙂 Thank you. ... View more