I have around 10 alerts set up in Slack, and I'm trying to find a way to find the total figure of each alert triggered in the previous month.  I'm using the following:   index="_internal" sourcetype="scheduler" thread_id="AlertNotifier*" NOT (alert_actions="summary_index" OR alert_actions="") | search savedsearch_name IN..... | stats count by savedsearch_name | sort -count   This works, and brings up some figures for all 10 alerts, however, for some reason it doesn't seem to be accurate. For example, I know we receive multiple alerts in a day for one particular search query (which is set to fire every 15 mins) and so a count of 23 in the previous month just isn't correct. What am I doing wrong?    Ps I'm a complete newbie here. Thanks in advance! ... View more