Thanks! Was able to finish the final search: (index=windows OR index=_internal) (source="WinEventLog:Security" (EventCode="1105" OR EventCode="1102") OR (source=*metrics.log group=tcpin_connections earliest=-2d@d arch=x64)) OR sourcetype="Symantec:VirusDefs" OR sourcetype="PowerShell:WinSystemInfo" NOT PS_SN="VMware-*" | eval age = (now() - _time ) | stats latest(PS_OS_Version) as OSVersion latest(PS_W10_Build) as W10Build latest(PS_Manufac) as Manufac latest(PS_Model) as Model latest(PS_SN) as SN latest(PS_AV_Date) as AVDate latest(PS_BitLocker) as BitLocker latest(eval(if(EventCode="1105",Date,NULL))) as LastSecLogArchive latest(eval(if(EventCode="1102",Date,NULL))) as LastSecLogClear max(_time) as LastActive min(age) as age by host | convert ctime(LastActive) as "UF Last Active On" | eval Status=case(age < 1800,"Running",age > 1800,"DOWN") | rename Status as "UF Status" | table host,OSVersion,W10Build,AVDate,BitLocker,LastSecLogArchive,LastSecLogClear,"UF Status","UF Last Active On",Manufac,Model,SN ... View more

Thanks! How would you add in another search like this? index=_internal source=*metrics.log group=tcpin_connections earliest=-2d@d arch=x64 | eval age = (now() - _time ) | stats min(age) as age, max(_time) as LastTime by hostname | convert ctime(LastTime) as "UF Last Active On" | eval Status=case(age < 1800,"Running",age > 1800,"DOWN") | rename Status as "UF Status" | table hostname,"UF Status","UF Last Active On" ... View more

The passwd file did not exist. I'm thinking something went wrong with the install, as a new install worked fine. ... View more