Hello, I've been working on using the above SPL to achieve a feed monitoring alert. I would like to point out a small but important error in logic in the above SPL. The code to create the lookup table references "time" which gives the current time during execution. Therefore, as you increase the time of the search the delta becomes the difference between the current time and the time of the event. What actually needs to happen is the comparison of Event Time and Ingest time which would give you the delta in event delivery. Line 3 in the lookup should be replaced with: | eval delta = _indextime - latest_time ... View more