Hi @gdfasdasd , in the post is written also:  'if Splunk has the data - it is indexed and searchable', so only indexed data are searchable. If you discard an event and you don't index it, you cannot search it. So I confirm, that you can search only on indexed data, with the exception of DB-Connect with performances to forget. Ciao. Giuseppe ... View more