Hello @jpolvino. I ve added the print of mu job inspector results. What I m trying to achieve is. I have 2 sourcetypes one is the connection and the other collector. The fist one, the field I need to use is src, the second is name. So I m trying to check each event and if src is null consider the name. After that, I m formatting _time as date, and the SubnetName is a common field for both sourcetypes. The result I need is to list distinct src by each network by day. I really would like to optimize this search to reduce the search cost. I m checking the link you ve sent looking for more hints. Thanks ... View more

Hello @efavreau. As I have 2 sourcetype and one has src and other name. Does it work to add before the first pipe (src=* OR name=*) Thanks ... View more

Hello @richgalloway . To search the last 24hours (~200M events ) takes around 45 minutes. and generates ~80k Results. Thanks. ... View more