Hi @gcusello Here are the searches: Dashboard query : index="summary_index1" "search_name=summary_index1*" | eval SLR01 = if((duration>1.8 OR duration=0),"Breached","Not Breached") | where LC>1|dedup isoClearSysRef |stats count(eval(SLR01="Breached")) as Transaction_Count, count(SLR01) As Total_Transaction_Count|eval CountStatus= Transaction_Count+"/"+Total_Transaction_Count| table CountStatus Results = CountStatus 0/0 Savedsearch for "summary_index1*" index="test_index1" sourcetype="test_sourcetype" queueName=queue1 OR queueName=queue2 OR queueName= queue3 | rename isoMsgDefId as MD, queueName as QN | eval MD1=split(MD,"."), QN1=split(QN,"."), MD2=mvindex(MD1,0), MD3=mvindex(MD1,1) ,QN2=mvindex(QN1,5), pacs=MD2+MD3, ID4= coalesce(isoInstructionId,isoOriginalInstructionId)| sort 0 timeStamp | dedup isoClearSysRef pacs sortby +_time| search NOT (pacs="pain001" OR pacs="pain002") | eval Time=strftime(timeStamp,"%m/%d/%Y %H:%M:%S.%Q")| transaction isoClearSysRef keepevicted=true | streamstats count by QN2 | where linecount>1 | eval "OLA Status" = if((duration>1.3 OR linecount<2),"Breached","Not Breached") | rename isoClearSysRef as PaymentID pacs as "Exit/Entry" duration as "OLA (sec)", QN as queueName, timeStamp as "Time Stamp" ID4 as "isoInstructionID" | table "Time Stamp" queueName "Exit/Entry" "OLA (sec)" "OLA Status" PaymentID isoInstructionID | search NOT [search index=summary_index1 search_name=summary_index1| table "OLA (sec)" "OLA Status" PaymentID isoInstructionID ] | collect index=summary_index1 marker="search_name=summary_index1" Results = No results to summary index. Also, I have been seeing below messages on SHC: Received event for unconfigured/disabled/deleted index=summary_index5 with source="source::sourcexxx" host="host:xxx" sourcetype="sourcetype::stash". So far received events from 7 missing index(es). Is it something related to this issue? note: the index configurations are available on indexers.
... View more