Hello, I am new to SPLUNK and have gone through the tutorials about searching for data and have managed to find some basic things I am looking for. However this is my situation: I have an App that writes to the Windows event log. It writes out some name value pairs that end up looking like this in the Windows Event log and in the SPLUNK events: Message=The VB Application identified by the event source logged this Application XXX: Thread ID: 5924 ,Logged: Process=XXXX ID={XXXXXX-696B-4136-9162-5DE0FA5D5F64} Time=3214. The bolded part is what the App writes to the event log. I can find these specific events fine but now I would like to create an alert when the "Time" value is over a certain amount (performance monitoring). I've tried various combinations in my search ("time>3000"; time>3000; "time!=2***" etc) but each time I get 0 results. Can I create a search out of a message string that includes numeric functions? Something like this Time>3000? Thanks for any help!! BB ... View more