Thank you so much for the quick response. I'm a noob, and what I've done so far is take the Splunk learning courses available to me and watched YouTube videos as well, on creating alerts. I've read over the material available to me at work (playbooks on related alerts) and I've been reading up on the topic areas in AWS. I have also found a Splunk quick reference guide on how to create queries, but I must admit it's all new to me so I was reaching out for any advice or pro tips. I have a background in construction and from that experience I learned the value of simple tricks or tips other people have learned from having experience. Even just presenting me with the question of if I have a search yet, is valuable advice. I don't but that helps a lot. Thanks again ... View more