When I run this query to give me results for the last 24 hours, its takes hours to complete. I would like to run it for say 30 days, but the time it takes would be unreasonable.  index=firewall sourcetype=cp_log:syslog source=checkpoint:firewall dest="172.24.245.210" | fields dest, src | dedup dest, src | table dest, src I am looking to identify any front end application server that connects to this 172.24.245.210 server     ... View more