Thanks livehybrid,  The first option worked perfectly. I only wanted the field to be sanitized at search time and the first option does that. Cheers.   ... View more

I am having a similar issue however in my case the field always has a suffix of sophos_event_input after the username. Example User Joe-Smith, Adams sophos_event_input Jane-Doe, Smith sophos_event_input I would like to change the User field to User Joe-Smith, Adams  Jane-Doe, Smith  Basically I want to get rid of the sophos_event_input suffix. How will I go about this?  ... View more

Thanks @splunkmarroko, Thanks. I tried that, however going about it that way returns the initial events with an "Active" status and does not take into consideration that the status has changed from "Active" to "Resolved". ... View more

Thanks @livehybrid, This works but returns inaccurate results when the search is run using the real time search time filter. This is an example of what I have; | base_search here | stats latest(status) as latest_status by incidentId | where latest_status!="Resolved" | stats count as total   The output is to count the number of active incidents to be displayed on a dashboard. Any pointer or tips on how to better achieve this will be appreciated. Cheers. ... View more