Hi there, I've got a basic search to provide the most recent timestamp for a successful backup using wineventlog data:   index="wineventlog" source="WinEventLog:Application" SourceName="Symantec System Recovery" host=*grp* | search Message=*6C8F1F7E* OR Message=*6C8F1F7D* OR Message=*6C8F1F7A* | dedup host | table host, _time   However, I'm really struggling to come up with a search that shows me all the *grp* hosts whether they have the successful backup strings in the Message field  (*6C8F1F7E* or *6C8F1F7D* or *6C8F1F7A*) or not. My closest attempt seems to be this:   index="wineventlog" source="WinEventLog:Application" SourceName="Symantec System Recovery" host=*pgrp* | eval success = case(Message like "%6C8F1F7E%",1,Message like "%6C8F1F7D%",1,Message like "%6C8F1F7A%",1,Message like "%",0) | stats sum(success) as Successes by host | where Successes < 1   My hope is for a table with the following columns: Host Last successful backup date/time or "N/A" if there was no successful backup in the selected timerange Days since last backup Any help or advice would be greatly apprecated! Cheers ... View more