Yee, exactly.  So, we've a SOC with multiple use-cases. Sometimes the pipeline between the ticketing tool and Splunk goes down or sometimes Splunk itself goes down. So, we need to run the correlation searches in that time-frame manually to check for any alerts. What we're trying to do is create a query / dashboard to do that for you. As of now, I could only find the below query but it goes irregular results or sometimes doesn't work at all. | makeresults | eval search=[| rest splunk_server=local /servicesNS/-/-/saved/searches | where title="SomeAlert" | fields qualifiedSearch | rename qualifiedSearch as query | format "" "" "" "" "" ""] | map search="| makeresults | map search="$search$ ... View more