See if this gets you started. <<your search for events>> ```Determine if the event is from today or yesterday ``` | eval day=if((now() - _time) >= (now() - relative_time(now(), "@d")),"today", "yesterday") ```Keep the most recent event today and yesterday for each URL | dedup url, day ```List the actions for each URL``` | stats list(action) as actions, values(*) as * by url ```Keep the events with different actions | where mvcount(actions) = 2 ```Keep the events where the first action is 'allowed' and the second is 'blocked'``` | where (mvindex(actions,0)="allowed" AND mvindex(actions,1)="blocked") ... View more

Hi @abhijeets, The itsi_summary index is a special-purpose index used by Splunk IT Service Intelligence (ITSI) to store KPI data, service analyzer data, and other ITSI-specific summary information. Key points about itsi_summary: Stores calculated KPI results and service health scores Contains event-based and metric-based KPI data Used for historical analysis and reporting in ITSI Data retention follows standard index configuration settings For detailed documentation: Overview: https://docs.splunk.com/Documentation/ITSI/4.20.0/Configure/IndexOverview itsi_summary specifically: https://docs.splunk.com/Documentation/ITSI/4.20.0/Configure/IndexRef 🌟 Did this answer help you? If so, please consider: Adding kudos to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

Thank you @SanjayReddy  ... View more