Hi anava One way I can think of is that you simply disable the App in which your saved searches / alert are located during the maintenance. This way the saved searches are not run any more and you will not get any alerts. After the maintenance enable your App and everything will be back normal. If your saved searches are not in another App then the Search App by now, this would be a good opportunity to move them into one. Because you shouldn't disable the Search App! Also there used to be an App where you were able to mark host for maintenance so you will not get spammed by alerts....but sadly I cannot recall the name of it 😞 cheers, MuS ... View more

You should use stats in a slightly different manner. The problem is that you are now grouping by a field that will have different values, namely the recDate . Instead you should only group by the first two, and just attach the lowest/earliest value of date for every combination of filingType and application , along with the count. If your recDate is in the format you specify you may need to alter that a bit for sorting purposes. Alternative A (this assumes that events you have came in chronologically, which makes the last retrieved event have the earliest recDate - remember that a search always returns the newest events first); ...| stats c last(recDate) as recDate by filingType, application Alternative B (which may be just as good, though just a little longer query); ...| eval rd = strptime(recDate, "%Y-%m-%d") | stats c min(rd) as recDate by filingType, application | eval recDate = strftime(recDate, "%Y-%m-%d") This converts the date string into epoch for each event, which makes it easy to find the min() of that. Then it's converted back to a string for presentation purposes. EDIT: typos and errors Hope this helps, Kristian ... View more