Hi folks, I have been trying to create a query that would list index name and earliest event from a list of indexes that started getting events only during the selected time range. First I'd populate the list of indexes using a query like so    index=_internal source=/opt/splunk/var/log/splunk/cloud_monitoring_console.log* TERM(logResults:splunk-ingestion) | rename data.* as * | fields idx     I want to find out which of the indexes out of this list started to index events for the first time only in the, say, last one month. I tried joining this query over idx like so where `tstats` would give me the earliest event timestamp in the last 6 months (a good approximation of whether that index ever got data before the last one month).   index=_internal source=/opt/splunk/var/log/splunk/cloud_monitoring_console.log* TERM(logResults:splunk-ingestion) | rename data.* as * | fields idx | rename idx as index | join index [ | tstats earliest(_time) as earliest_event where earliest=-6mon latest=now index=* by index | table index earliest_event]    But this is only giving me correct results when I specify an index name in the base query. For some reason, it doesn't give me proper results for all indexes. I tried the `map` command as well passing index dynamically but the performance of that query isn't ideal as there are 100s of indexes. I also tried other commands like append but none would give the outcome as expected. I think that there is an obvious solution here that's somehow eluding me. Appreciate any help around this. ... View more