@ITWhisperer Thanks, tried but don't see any difference  streamstats looks better option, not sure how can we save max and min values as variable and and then do subtraction Tried following (it is always giving latest result), was expecting output only when queue is not dequeuing for last an hour sourcetype=amq_queues queue=ABC | where size > 0 | streamstats max(dequeueCount) as maximum min(dequeueCount) as minimum | where maximum - minimum = 0     ... View more