I have the following search to calculate the RetentionDays of all the indexes in a cluster, but I'm unable to fetch the RetentionDays of the specific index name out of the results which has returned by the below search. | rest/services/data/indexes splunk_server="*-splunkp*" | stats max(eval(round(frozenTimePeriodInSecs/86400))) as RetentionDays by title | rename title as index This search returns multiple indexes and for an instance, I need only book_core from the search. How do I filter it? ... View more